CVE-2026-110023 Details
Description
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.
A vulnerability allowing sensitive information exposure exists in the WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress, in all versions through 5.5.88. The issue arises from the 'rel_tab' parameter, which can be exploited by unauthenticated attackers to access every row and column of the database table linked to any anonymously published app. This includes extraction of WordPress user password hashes, email addresses, and password-reset keys from the wp_users table. The vulnerability exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the default for publicly embedded apps.
Users are advised to update the WP Data Access plugin to version 5.5.89 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP Data Access | <= 5.5.88 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |