CVE-2026-106098: WP Data Access Auth Bypass Vulnerability

CVE-2026-106098 Overview

CVE-2026-106098 is a broken access control vulnerability in the WP Data Access WordPress plugin versions prior to 5.5.77. The plugin exposes a REST endpoint that verifies only read permissions before performing write operations. Unauthenticated attackers can modify data in applications configured for anonymous read access, bypassing administrator restrictions that disable update actions. The flaw is tracked under CWE-863: Incorrect Authorization.

Critical Impact

Unauthenticated remote attackers can modify data through a REST API endpoint, even when administrators have explicitly disabled update actions in the plugin configuration.

Affected Products

• WP Data Access WordPress plugin versions prior to 5.5.77
• WordPress sites exposing WP Data Access applications for anonymous read access
• WordPress installations using the plugin's application REST endpoints

Discovery Timeline

• 2026-10-14 - CVE CVE-2026-106098 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-106098

Vulnerability Analysis

The WP Data Access plugin provides data management capabilities for WordPress administrators, including the ability to publish database applications as public-facing read-only interfaces. One of these application REST endpoints contains an authorization logic flaw where the handler validates only read permission before executing write operations.

This mismatch between the permission check and the action performed enables unauthenticated attackers to send write requests through an endpoint intended to serve read-only queries. Administrators who intentionally disable update actions in the application settings do not receive the protection they expect, because the endpoint never consults the configured write authorization state.

The impact is limited to data integrity. The vulnerability does not expose confidential data or crash the service, but it undermines data trust for any application exposed anonymously.

Root Cause

The root cause is an authorization check that validates the wrong operation type. The REST endpoint implements a permission callback that returns success when the caller has read access, then performs an update, insert, or delete operation without re-validating authorization for the write action. This is a classic [CWE-863] incorrect authorization pattern.

Attack Vector

An attacker identifies a WordPress site running WP Data Access with an application configured for anonymous access. The attacker sends a crafted HTTP request to the affected REST endpoint containing write parameters. The plugin accepts the request because the read permission check passes, and the write operation modifies plugin-managed data. No authentication, user interaction, or elevated privileges are required.

The vulnerability is exploitable over the network against any affected site with a publicly reachable WordPress REST API. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-106098

Indicators of Compromise

• Unexpected POST, PUT, PATCH, or DELETE requests to WP Data Access REST endpoints under /wp-json/ from unauthenticated sources
• Unexplained row-level modifications in tables managed by WP Data Access applications
• Access log entries showing write-method requests to endpoints that administrators configured as read-only

Detection Strategies

• Review WordPress REST API access logs for requests to WP Data Access application routes using HTTP methods other than GET or HEAD
• Compare plugin version strings against the fixed version 5.5.77 across the WordPress estate
• Enable database auditing on tables exposed through WP Data Access applications to capture unauthorized modifications

Monitoring Recommendations

• Alert on anonymous write requests to WordPress REST endpoints associated with WP Data Access
• Baseline normal request patterns to the plugin's REST routes and flag deviations in HTTP method distribution
• Track plugin version drift across managed WordPress deployments to confirm patch adoption

How to Mitigate CVE-2026-106098

Immediate Actions Required

• Upgrade the WP Data Access plugin to version 5.5.77 or later on all WordPress installations
• Audit all WP Data Access applications configured for anonymous access and review recent data modifications
• Temporarily disable public applications until the patch is applied if upgrade cannot be completed immediately

Patch Information

The vendor addressed the vulnerability in WP Data Access version 5.5.77. The fix enforces correct authorization checks for write actions on the affected REST endpoint. Refer to the WPScan Vulnerability Report for the advisory details.

Workarounds

• Disable anonymous access on all WP Data Access applications until the plugin is updated
• Restrict access to the affected REST endpoints at the web server or WAF layer, blocking non-GET methods
• Deactivate the WP Data Access plugin on sites that cannot be patched promptly

# Example: block non-GET methods to WP Data Access REST routes in nginx
location ~ ^/wp-json/wpdataaccess/ {
    limit_except GET HEAD {
        deny all;
    }
}