CVE-2026-106098
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission befor…
Published Oct 14, 2026 · updated Oct 14, 2026
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
Oct 14, 2026 · NIST NVD
Updated
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
Sources
- CVE.orgCVE-2026-106098
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-106098
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2026-106098
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonym
nvd.nist.gov