Medium severity · published Oct 14, 2026
CVE-2026-106099
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WD
WP Data Access ·
before 5.5.84 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106099
exploit
https://wpscan.com/vulnerability/65544ed7-d80b-439e-bf8e-73e94041b6bb/
More from WP Data Access
9.8
CVE-2021-24866
WP Data Access < 5.0.0 - Admin+ SQL Injection
7.5
CVE-2026-18032
WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass
5.3
CVE-2026-106098
WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update
5.0
CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF