CVE-2026-106098: CWE-863 Incorrect Authorization in WP Data Access
Description
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
CVSS v3.1
Score 5.3medium
Affected software
WP Data Access
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-106098 is an authorization bypass vulnerability in the WP Data Access WordPress plugin versions prior to 5.5.77. The plugin's REST endpoint fails to properly verify write permissions, checking only for read access before allowing data modification. This incorrect authorization check permits unauthenticated attackers to perform write operations on data that should be protected, despite administrative settings intended to disable updates.
Potential Impact
Unauthenticated attackers can modify application data through the vulnerable REST endpoint. This can lead to unauthorized data changes in applications that are otherwise exposed only for anonymous read access. The vulnerability undermines administrative controls that disable update actions, potentially compromising data integrity.
Mitigation Recommendations
Upgrade the WP Data Access plugin to version 5.5.77 or later where this authorization issue is fixed. Patch status is confirmed by the version boundary in the affectedVersions field. No other mitigation is indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-06T15:26:49.993Z
- State
- PUBLISHED
Threat ID: 6acf22532cdf04f65651379f
Added to database: 10/14/2026, 06:33:55 UTC
Last enriched: 10/14/2026, 07:19:04 UTC
Last updated: 10/14/2026, 14:04:16 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.