# CVE-2026-42665: WP Data Access unauthenticated SQL injection

Source: https://junglewise.ai/threats/cve-2026-42665-wp-data-access-unauthenticated-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-42665 · Severity: critical · CVSS 9.3 · Published 2026-06-15

WP Data Access, a WordPress plugin used for managing and displaying database tables, contains a critical security flaw. An unauthenticated attacker can remotely access and manipulate the website's database without needing a password. This could lead to the theft of sensitive customer information, unauthorized modification of site content, or a partial disruption of services.

Technologies: [WP Data Access](https://junglewise.ai/threats/technologies/wp-data-access). Vendors: [WP Data Access](https://junglewise.ai/threats/vendors/wp-data-access).

## Quick answers

**Is CVE-2026-42665 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42665 being exploited in the wild.

**How severe is CVE-2026-42665?** Critical severity, with a CVSS score of 9.3, published 15 June 2026.

**Which products and versions are affected?** WP Data Access <= 5.5.70.

**Is there a fix for CVE-2026-42665?** A patch was published on 2026-05-09: Version 5.5.71 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42665 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42665?** Check whether you run WP Data Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability (CWE-89) exists in the WP Data Access plugin for WordPress due to improper neutralization of special elements in SQL commands. The flaw is accessible to unauthenticated remote attackers over the network with low attack complexity. By sending specially crafted requests, an attacker can bypass security controls to directly interact with the underlying database. This can result in high-impact data exfiltration and limited impact on system availability. The vulnerability is patched in version 5.5.71.

## Affected products

- WP Data Access WP Data Access <= 5.5.70

## Timeline

- 2026-04-09: other: Reported by Mukhlis Amien
- 2026-05-09: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: CVE published to NVD
- 2026-05-09: patched: Version 5.5.71 released to address the vulnerability

## References

- [https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-70-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-70-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [WP Data Access plugin sensitive information exposure via REST API](https://junglewise.ai/threats/cve-2026-110023-the-wp-data-access-app-builder-for-tables-forms-dashboards)
- [WP Data Access WordPress plugin SSRF in action](https://junglewise.ai/threats/cve-2026-106470-the-wp-data-access-wordpress-plugin-before-5-5-88-does-not-have)
- [WP Data Access SQL injection](https://junglewise.ai/threats/cve-2026-93621-unauthenticated-sql-injection-in-wp-data-access-5-5-84-versions)
- [WP Data Access SQL Injection](https://junglewise.ai/threats/cve-2026-81293-wp-data-access-sql-injection)
- [WP Data Access broken access control authentication bypass](https://junglewise.ai/threats/cve-2026-66595-wp-data-access-broken-access-control-authentication-bypass)