CVE-2026-42665: WP Data Access SQLI Vulnerability

CVE-2026-42665 Overview

CVE-2026-42665 is an unauthenticated SQL injection vulnerability affecting the WP Data Access plugin for WordPress in versions up to and including 5.5.70. The flaw is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Attackers can exploit this vulnerability over the network without authentication or user interaction. Successful exploitation allows injection of arbitrary SQL queries against the WordPress database, with a scope change that can extend impact beyond the vulnerable plugin component.

Critical Impact
Unauthenticated attackers can inject SQL queries remotely, exposing confidential database contents and degrading site availability across affected WordPress installations.

Affected Products

WP Data Access plugin for WordPress, versions <= 5.5.70
WordPress sites with the WP Data Access plugin installed and active
Any environment exposing the vulnerable plugin endpoints to untrusted networks

Discovery Timeline

2026-06-15 - CVE-2026-42665 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-42665

Vulnerability Analysis

The vulnerability resides in the WP Data Access WordPress plugin at or below version 5.5.70. The plugin fails to properly sanitize or parameterize user-controlled input before incorporating it into SQL statements executed against the WordPress database.

Because exploitation requires no authentication and no user interaction, any remote actor able to reach the affected WordPress endpoint can submit crafted parameters. The scope change associated with this issue indicates that exploitation can affect resources beyond the immediate plugin context, including the broader WordPress database schema.

The issue maps to [CWE-89], a well-understood class where input flows into a SQL query without being treated as data. Refer to the Patchstack SQL Injection Vulnerability advisory for technical details.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands. User-supplied values reach SQL execution paths without being bound as parameters or sufficiently escaped. This permits attacker-controlled fragments to alter query structure and execute unintended database operations.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request containing a malicious payload to a vulnerable plugin endpoint. The injected SQL is then executed by the WordPress database server with the privileges of the WordPress database user.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism, however, follows the standard SQL injection pattern documented in the Patchstack advisory referenced above.

Detection Methods for CVE-2026-42665

Indicators of Compromise

HTTP requests to WP Data Access plugin endpoints containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP( in query or POST parameters
Unexpected outbound database query patterns originating from the WordPress process, including UNION-based reads against wp_users or wp_options
Web server access logs showing repeated parameter fuzzing against plugin routes under /wp-admin/admin-ajax.php or plugin-specific paths
Database error messages surfacing in HTTP responses from plugin pages

Detection Strategies

Deploy WordPress-aware web application firewall (WAF) rules that flag SQL injection signatures targeting WP Data Access parameters
Enable MySQL or MariaDB general query logging on staging systems to baseline plugin query shapes and identify deviations
Inspect WordPress audit logs for unexpected administrative changes, new user creation, or option table modifications

Monitoring Recommendations

Forward web server, WordPress, and database logs to a centralized analytics platform for correlation
Alert on bursts of 4xx and 5xx responses from plugin endpoints, which often accompany injection probing
Monitor for new or modified administrator accounts and changes to the siteurl and home options in wp_options

How to Mitigate CVE-2026-42665

Immediate Actions Required

Identify all WordPress installations running the WP Data Access plugin and inventory installed versions
Update WP Data Access to a version newer than 5.5.70 once a patched release is available from the vendor
Restrict access to WordPress admin and plugin endpoints by IP allowlist where feasible until patching is complete
Review database and WordPress logs for evidence of prior exploitation, including unauthorized account creation

Patch Information

The vulnerability affects WP Data Access versions <= 5.5.70. Administrators should consult the Patchstack advisory and the plugin vendor for the fixed release version and apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Deactivate and remove the WP Data Access plugin until a fixed version is installed
Deploy a WAF rule set that blocks SQL injection payloads against plugin parameters
Apply least-privilege to the WordPress database user, removing FILE, CREATE, and DROP privileges where not required

bash

# Configuration example: identify and update WP Data Access via WP-CLI
wp plugin list --name=wp-data-access --fields=name,status,version
wp plugin update wp-data-access
wp plugin deactivate wp-data-access  # if no patched version is yet available