# CVE-2026-118267: WP Data Access privilege escalation via missing authorization checks

Source: https://junglewise.ai/threats/cve-2026-118267-the-wp-data-access-app-builder-for-tables-forms-dashboards  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-118267 · Severity: high · CVSS 8.1 · Published 2026-11-07

The WP Data Access plugin for WordPress is a tool that allows administrators to build database-driven apps including tables, forms, and dashboards. An authenticated attacker with basic Subscriber account privileges can bypass security restrictions on database write operations to modify arbitrary data—including overwriting administrator account credentials—leading to complete site takeover if the administrator has configured write access for lower-privilege users.

Vendors: [WP Data Access](https://junglewise.ai/threats/vendors/wp-data-access).

## Quick answers

**Is CVE-2026-118267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118267 being exploited in the wild.

**How severe is CVE-2026-118267?** High severity, with a CVSS score of 8.1, published 7 November 2026.

**Which products and versions are affected?** WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps up to and including 5.5.89.

**Is there a fix for CVE-2026-118267?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118267 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118267?** Check whether you run WP Data Access – App Builder for Tables, Forms, Dashboards or Charts & Maps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) fail to enforce row-level filters (`defaultWhere`) and column-level access control (`isSelected`) when processing attacker-supplied `key` and `val` parameters, whereas read endpoints correctly enforce these restrictions. Authenticated attackers with Subscriber-level access or above can exploit this to write to any row and column in the database, including modifying the WordPress administrator password field. Exploitation is simplified when administrators have explicitly enabled write transactions for lower-privilege users as part of the plugin's documented functionality.

## Affected products

- WP Data Access WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps up to and including 5.5.89

## Timeline

- 2026-11-07: disclosed