CVE-2026-118267

{
  "etk_id": "ETK-2026-3851",
  "cve_id": "CVE-2026-118267",
  "display_id": "CVE-2026-118267",
  "ghsa_id": "GHSA-v86c-jgq8-6hrh",
  "euvd_id": "EUVD-2026-119157",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in WP Data Access write operations",
  "summary": "WP Data Access through version 5.5.89 can allow write requests to bypass Data App row and column restrictions. An attacker may modify protected WordPress data and obtain administrative control when a published Data App permits update, delete, or insert operations for subscriber or anonymous users.",
  "mitigation": "Disable update, delete, and insert transactions on Data Apps accessible to subscriber or anonymous users, or limit those apps to trusted administrators. Review published Data Apps for anonymous authorization and remove it where it is not required.",
  "vendor": "wpdataaccess",
  "product": "WP Data Access",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 5.5.89"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.011031816666666666,
  "t0_at": "2026-11-07T11:26:32.742000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-07T17:05:35.116785+00:00",
      "days": 0.23544415260416668,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T11:26:32.742000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-11-07T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T11:26:32.742000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-118267"
    },
    "trigger_signal": {
      "at": "2026-11-07T00:00:00+00:00",
      "days": -0.4767678472222222,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T11:26:32.742000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-118267"
    }
  }
}