What’s Vulnerable › Vulnerabilities

CVE-2026-3235: WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-08-28
• Weakness: CWE-639

Description

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).

Affected products

• peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards: through 5.5.68

References

• https://plugins.trac.wordpress.org/browser/wp-data-access/trunk/WPDataAccess/API/WPDA_Apps.php#L2387
• https://plugins.trac.wordpress.org/browser/wp-data-access/trunk/WPDataAccess/API/WPDA_Apps.php#L2400
• https://plugins.trac.wordpress.org/browser/wp-data-access/trunk/WPDataAccess/Plugin_Table_Models/WPDA_App_Container_Model.php#L50
• https://plugins.trac.wordpress.org/changeset/3477673/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/935f5d76-d63a-4db4-b645-b7961ae8bfaf?source=cve

Get alerted when CVE-2026-3235 or the next vulnerability affects your stack