Executive brief
WP Data Access is a popular WordPress plugin that allows users to create database-driven applications without coding. The plugin is vulnerable to an authorization bypass flaw that allows unauthenticated attackers to access sensitive data stored in protected app containers by manipulating object identifiers, potentially exposing customer data and business-critical information.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the 'check_app_access' function of WP Data Access. The root cause is a mismatch between authorization and data retrieval: the authorization check validates against app_id, but the actual data retrieval uses cnt_id without verifying that the container belongs to the authorized app. This allows unauthenticated attackers to bypass authorization by crafting requests with arbitrary cnt_id values. No authentication is required to exploit this vulnerability. The fix involves validating container ownership before data retrieval.
Affected products
- 10Web WP Data Access up to 5.5.68
Timeline
- 2026-08-26: disclosed