CVE-2026-18032: WP Data Access Information Disclosure

CVE-2026-18032 Overview

CVE-2026-18032 is an information disclosure vulnerability in the WP Data Access WordPress plugin versions before 5.5.79. The plugin fails to validate column names accepted by one of its unauthenticated AJAX actions. The nonce protecting that action does not cover the column parameter, leaving it unenforced. Unauthenticated attackers can read arbitrary columns from the database table bound to the affected front-end form. When the bound table is the WordPress users table, attackers can extract password hashes for offline cracking. The issue is tracked as CWE-200: Exposure of Sensitive Information.

Critical Impact
Unauthenticated attackers can extract user password hashes and other sensitive database column values from affected WordPress sites over the network.

Affected Products

WP Data Access WordPress plugin versions prior to 5.5.79
WordPress sites using WP Data Access front-end forms bound to the users table
WordPress sites exposing WP Data Access forms bound to any table containing sensitive data

Discovery Timeline

2026-08-09 - CVE-2026-18032 published to the National Vulnerability Database
2026-08-10 - Last updated in the NVD database

Technical Details for CVE-2026-18032

Vulnerability Analysis

WP Data Access exposes an AJAX action intended to power front-end data forms. The action accepts a column name parameter that determines which database column value is returned. The plugin does not maintain an allowlist of columns permitted for the bound form. Attackers can substitute any column name in the target table and receive its contents in the response.

The action is reachable without authentication. The nonce token used by the plugin does not incorporate the column parameter into its validation scope. An attacker who obtains or replays a valid nonce, or who reaches an endpoint where the nonce check omits the column field, can freely alter the requested column.

When the affected form is bound to the wp_users table, the response exposes columns such as user_pass, user_email, and user_activation_key. Password hashes retrieved this way can be attacked offline using tools targeting the WordPress phpass or bcrypt formats.

Root Cause

The root cause is missing server-side input validation on the column parameter, combined with an incomplete nonce scope. The plugin trusts client-supplied column identifiers and passes them into the database query without checking them against the columns intended to be exposed by the front-end form.

Attack Vector

Exploitation requires only network access to the WordPress site and knowledge of the vulnerable AJAX action name. An attacker sends a crafted admin-ajax.php POST request supplying a column name such as user_pass. The server responds with the value of that column for records visible through the front-end form. No user interaction and no authentication are required. See the WPScan advisory for full technical details.

Detection Methods for CVE-2026-18032

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing WP Data Access actions with column parameters such as user_pass, user_email, or user_activation_key
Repeated AJAX requests from a single source enumerating column names against the same form endpoint
Web server access logs showing WP Data Access AJAX responses containing hash-like strings beginning with $P$, $wp$, or $2y$

Detection Strategies

Inspect HTTP request bodies for WP Data Access AJAX action names paired with column parameters that do not match the columns rendered by legitimate front-end forms
Alert on outbound responses from admin-ajax.php that contain patterns matching WordPress password hash formats
Correlate anonymous AJAX traffic volume against baseline usage of WP Data Access forms to surface enumeration behavior

Monitoring Recommendations

Enable verbose logging on the WordPress front-end web server and forward admin-ajax.php requests to a central log platform for query and retention
Monitor failed and successful authentication events for accounts whose email addresses were recently referenced in WP Data Access AJAX traffic
Track plugin version inventory across WordPress deployments to identify hosts running WP Data Access below 5.5.79

How to Mitigate CVE-2026-18032

Immediate Actions Required

Upgrade WP Data Access to version 5.5.79 or later on every affected WordPress site
Rotate passwords for all WordPress user accounts on sites that exposed a front-end form bound to the users table
Invalidate active WordPress sessions and reset user_activation_key values for potentially impacted accounts
Review web server logs for prior exploitation attempts against WP Data Access AJAX endpoints

Patch Information

The vendor fixed the flaw in WP Data Access 5.5.79. Administrators should update through the WordPress plugin manager or by deploying the updated plugin archive. Refer to the WPScan vulnerability report for the authoritative fix reference.

Workarounds

Disable or remove WP Data Access front-end forms until the plugin is upgraded
Restrict access to admin-ajax.php at the web application firewall by blocking requests targeting WP Data Access actions from unauthenticated sources
Detach any WP Data Access front-end form currently bound to the wp_users table or other tables containing sensitive columns

bash

# Update WP Data Access using WP-CLI
wp plugin update wp-data-access --version=5.5.79

# Verify the installed version
wp plugin get wp-data-access --field=version