CVE-2026-106099: WP Data Access Information Disclosure Flaw

CVE-2026-106099 Overview

CVE-2026-106099 affects the WP Data Access WordPress plugin in versions prior to 5.5.84. The plugin exposes a database table export action without restricting it to authorized users. The export endpoint is gated only by a token that the plugin itself prints into the public pages where it renders tables. Unauthenticated attackers can read this token from the HTML and invoke the export action against any publicly displayed table. The export returns the complete table contents, including columns and rows that the plugin withholds from the visitor-facing display. This vulnerability is categorized under [CWE-200] Information Exposure.

Critical Impact
Unauthenticated attackers can exfiltrate full database table contents, including fields intentionally hidden from the public view.

Affected Products

WP Data Access WordPress plugin versions prior to 5.5.84
WordPress sites that publicly display tables rendered by the plugin
Any environment where the plugin exposes tables containing sensitive or filtered columns

Discovery Timeline

2026-10-14 - CVE-2026-106099 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-106099

Vulnerability Analysis

The WP Data Access plugin provides functionality to render database tables on public WordPress pages. Alongside the table display, the plugin registers an export action that returns the underlying table data. Access to this export action is controlled by a per-table token rather than by WordPress user capability checks or nonce verification tied to an authenticated session.

The plugin writes this same token into the HTML of any public page that renders the table. An unauthenticated visitor can retrieve the page, parse the token from the markup, and submit it back to the export endpoint. The server treats the token as sufficient authorization and returns the full table contents.

Columns and rows filtered out of the visitor-facing view are not filtered from the export response. The exported data includes fields the site operator intended to withhold from public visitors. The vulnerability is network-reachable and requires no user interaction.

Root Cause

The root cause is a broken access control pattern [CWE-200] in which the export action trusts a secret that the application publishes in cleartext on the same request surface. The token functions as neither a capability check nor a session-bound nonce. Server-side authorization is missing from the export handler, and the output filtering applied to the display view is not reapplied to the export path.

Attack Vector

An attacker fetches a public WordPress page that renders a WP Data Access table. The attacker extracts the export token embedded in the response body. The attacker then issues an HTTP request to the plugin's export endpoint with the extracted token. The endpoint returns the complete table contents, including hidden columns and rows. The attack requires no credentials, no privileges, and no interaction from a legitimate user.

No verified public proof-of-concept code is available. See the WPScan Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2026-106099

Indicators of Compromise

HTTP requests to WP Data Access export endpoints originating from clients that did not authenticate to WordPress
Repeated requests to the same export action with distinct token values harvested from public pages
Outbound responses from the WordPress server containing serialized table exports to anonymous clients
Spikes in response size for admin-ajax.php or plugin-specific endpoints associated with WP Data Access

Detection Strategies

Review WordPress and web server access logs for requests to WP Data Access export actions where the session cookie indicates an unauthenticated visitor.
Compare request-source IP addresses for the public page view and the subsequent export call to identify automated scraping patterns.
Baseline normal response sizes for plugin endpoints and alert on anomalously large payloads returned to anonymous clients.

Monitoring Recommendations

Forward WordPress access logs and PHP error logs into a centralized log pipeline for correlation and retention.
Monitor for user-agent strings and request cadences consistent with scripted enumeration of plugin endpoints.
Track outbound data volume from the WordPress host and alert on sustained increases that correlate with plugin export URLs.

How to Mitigate CVE-2026-106099

Immediate Actions Required

Upgrade the WP Data Access plugin to version 5.5.84 or later on all affected WordPress installations.
Audit public pages that render WP Data Access tables and remove any tables that expose sensitive data until the upgrade is confirmed.
Review web server logs for prior access to plugin export endpoints by unauthenticated clients and treat any matches as potential data exposure.

Patch Information

The vendor has addressed CVE-2026-106099 in WP Data Access version 5.5.84. Administrators should apply this update through the WordPress plugin management interface or via wp-cli. Confirm the installed version after upgrade and verify that export actions reject requests from unauthenticated clients. Refer to the WPScan Vulnerability Advisory for vendor fix references.

Workarounds

Unpublish or restrict access to WordPress pages that render WP Data Access tables until the plugin is upgraded.
Place a web application firewall rule in front of the WordPress site that blocks unauthenticated requests to the plugin's export endpoints.
Remove sensitive columns from any table definition rendered on public pages so that even an unauthorized export returns no confidential data.

bash

# Upgrade WP Data Access using wp-cli
wp plugin update wp-data-access --version=5.5.84
wp plugin get wp-data-access --field=version