CVE-2026-3235 Overview
The WP Data Access plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability affecting all versions up to and including 5.5.68. The flaw resides in the check_app_access function, which performs authorization against an app_id parameter while retrieving data using a separate cnt_id parameter. This mismatch allows unauthenticated attackers to read data from protected app containers they do not own. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated network attackers can access data from protected app containers by supplying a cnt_id that does not match the authorized app_id, resulting in confidentiality loss across affected WordPress sites.
Affected Products
- WP Data Access plugin for WordPress, all versions through 5.5.68
- WordPress sites with the plugin installed and app containers configured
- Fixed in the release referenced by changeset 3477673
Discovery Timeline
- 2026-08-26 - CVE-2026-3235 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
- Additional details are available in the Wordfence Vulnerability Report
Technical Details for CVE-2026-3235
Vulnerability Analysis
The WP Data Access plugin exposes REST API endpoints that operate on "app containers," which are logical groupings of application data. The check_app_access function acts as the authorization gate for these endpoints. It validates that the requester has access to an application identified by app_id, then loads container data using a separately supplied cnt_id value.
Because the plugin never verifies that the container referenced by cnt_id belongs to the application referenced by app_id, an attacker can request any container ID while presenting an app_id for which access is granted. The API responds with the container contents, bypassing the intended ownership boundary. Since the affected endpoint does not require authentication, exploitation requires no credentials and only a crafted HTTP request.
Root Cause
The root cause is a broken object-level authorization check. The relevant code paths are documented in the plugin source at WPDA_Apps.php line 2387 and line 2400, with the container lookup implemented in WPDA_App_Container_Model.php. The authorization decision and data retrieval operate on independent identifiers without a join or ownership check tying cnt_id back to the authorized app_id.
Attack Vector
An unauthenticated attacker sends a request to the vulnerable REST endpoint supplying an app_id value that passes the access check and a cnt_id value referencing a container owned by another application. The server returns the container payload. Attackers can enumerate cnt_id values sequentially to harvest data across tenants on a shared WordPress installation. Exploitation requires only network reachability to the site and knowledge of the endpoint path published in the plugin source.
Detection Methods for CVE-2026-3235
Indicators of Compromise
- Requests to WP Data Access REST endpoints where the cnt_id parameter varies while the app_id parameter remains constant across many requests from a single source
- Sequential or high-cardinality enumeration of cnt_id values in web server or WordPress access logs
- Unauthenticated API responses returning container data payloads to external IP addresses
Detection Strategies
- Inspect WordPress request logs for calls to WPDA_Apps API routes originating from unauthenticated sessions
- Compare app_id and cnt_id pairs in request logs against the plugin's container ownership records to identify mismatches
- Deploy a Web Application Firewall (WAF) rule that flags rapid variation of the cnt_id parameter in plugin API traffic
Monitoring Recommendations
- Alert on spikes in 200 OK responses from the WP Data Access API when originating from clients without authenticated WordPress session cookies
- Track outbound data volume from WordPress hosts running the plugin to detect bulk container extraction
- Correlate WordPress access logs with edge or CDN logs to identify distributed enumeration attempts against cnt_id
How to Mitigate CVE-2026-3235
Immediate Actions Required
- Update the WP Data Access plugin to a version later than 5.5.68 that includes the fix from changeset 3477673
- Audit existing WordPress installations to inventory sites running vulnerable versions of the plugin
- Review recent web server logs for evidence of cnt_id enumeration prior to patching
Patch Information
The vendor addressed the flaw in the WordPress plugin repository via changeset 3477673, which adds container ownership validation to the check_app_access code path. Site administrators should apply the update through the WordPress plugin manager. Additional analysis is available in the Wordfence Vulnerability Report.
Workarounds
- Disable the WP Data Access plugin until the patched version can be deployed if immediate updating is not possible
- Restrict access to the affected REST API endpoints at the WAF or reverse proxy layer, allowing only authenticated administrative IP ranges
- Remove or archive sensitive app container data from affected WordPress installations until the fix is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
