WP Data Access: Unauthenticated SQL Injection

Summary

The WordPress plugin WP Data Access in versions up to and including 5.5.84 is vulnerable to SQL Injection that can be exploited without logging in. An attacker can read, modify or delete database content, including user accounts and private data. The attack requires only network access to a public WordPress site running the affected plugin.

Affected

• WP Data Access WordPress plugin, versions <= 5.5.84

Fixed in

• Version 5.5.85 or later (according to the CVE record and Patchstack)
• The latest release on WordPress.org is 5.5.90

Workaround

• No vendor workaround known.
• Deactivate and remove the plugin if it is not essential.
• Restrict access to the plugin functionality where possible.
• Do not rely on a WAF as a verified fix unless the vendor or a security provider confirms the rule.

Exploitation

• Unauthenticated exploitation over the network with low complexity (CVSS 3.1: 8.2).
• CISA SSVC: exploitation none, automatable yes.
• Not listed in CISA KEV.
• No public proof of concept or confirmed exploitation found in a limited search.
• Patchstack expects exploitation and states it is used in mass-exploit campaigns.

Our recommendation

• Inventory all WordPress sites and check for WP Data Access and its version.
• Update the plugin to 5.5.85 or later, preferably the latest 5.5.x release.
• If an update is not possible quickly, deactivate the plugin on public-facing sites first.
• Back up the database before and after the update and check that the database account has only the required privileges.
• Check database and web server logs for unusual database errors or query patterns.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for CVE-2026-93621 patchstack.com
• WordPress.org plugin page WP Data Access wordpress.org
• WPScan plugin page WP Data Access wpscan.com
• Strix CVE record CVE-2026-93621 www.strix.ai
• Patchstack advisory for earlier SQL injection in WP Data Access (5.5.70) patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:42.