CVE-2026-81293: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Passionate Programmer Peter WP Data Access

This vulnerability (CVE-2026-81293) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the WP Data Access product by Passionate Programmer Peter. It affects all versions up to and including 5.5.81. The flaw allows unauthenticated attackers to inject SQL commands, resulting in a critical impact on confidentiality and a low impact on availability, with no required privileges or user interaction. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

An unauthenticated attacker can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database, leading to a complete loss of confidentiality of data and a low impact on availability. Integrity impact is not indicated. This could allow data disclosure or unauthorized data access. There is no indication of integrity compromise or denial of service beyond low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected WP Data Access installation and applying web application firewall rules to detect and block SQL injection attempts if feasible.