CVE-2026-95605: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Passionate Programmer Peter WP Data Access

This vulnerability involves improper neutralization of special elements used in an SQL command (CWE-89) within the WP Data Access plugin by Passionate Programmer Peter. It allows an unauthenticated attacker to conduct Blind SQL Injection attacks, which can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). The CVSS 3.1 base score is 9.3, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. The affected versions include all versions up to 5.5.82. There is no indication of known exploits in the wild or available patches at this time.

An attacker can exploit this vulnerability remotely without authentication to perform Blind SQL Injection, potentially leading to unauthorized access to sensitive data (high confidentiality impact) and limited denial of service (low availability impact). The integrity impact is reported as none. This could compromise the confidentiality of the affected system's database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor vendor communications for updates and consider applying any forthcoming patches promptly.