This vulnerability (CVE-2026-42665) is an unauthenticated SQL Injection in the WP Data Access plugin developed by Passionate Programmer Peter. It affects all versions up to 5.5.70. The issue arises from improper neutralization of special elements used in SQL commands (CWE-89), enabling attackers to execute arbitrary SQL queries without authentication. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation has been disclosed as of the publication date.

Successful exploitation could allow remote unauthenticated attackers to execute arbitrary SQL commands on the affected system, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. This could compromise the database contents of WP Data Access installations up to version 5.5.70.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable plugin or disabling it if possible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.