WP Data Access WordPress plugin: Blind SQL injection

Summary

The WordPress plugin WP Data Access up to and including version 5.5.82 is vulnerable to blind SQL injection. An unauthenticated remote attacker can send crafted requests to read data from the site's database, such as user accounts and private content. The CVSS score is 9.3 (critical), but the vector indicates high confidentiality impact and no integrity impact, so data disclosure is the main risk.

Affected

• WP Data Access plugin for WordPress, versions from n/a through 5.5.82
• Some sources state that version 5.5.83 may also be affected; this is unconfirmed.

Fixed in

• Update to version 5.5.83 or later (per CNA and Patchstack). Whether 5.5.83 is fully fixed is unconfirmed.

Workaround

• No vendor workaround known.
• Deactivate and remove the plugin if it is not needed.
• Restrict access to the plugin's admin and API endpoints by IP or VPN where feasible.
• Apply WAF virtual patching if your hosting provider offers it.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV.
• CISA SSVC: Exploitation none, Automatable yes.
• No public proof of concept found in the indexed sources at the time of research.
• Patchstack expects exploitation and mass-exploit campaigns.

Our recommendation

• Check whether WP Data Access is installed and which version is running.
• Update the plugin immediately to the latest release, at least 5.5.83, and verify the version in the WordPress.org changelog.
• If the plugin is not needed, deactivate and remove it.
• Limit the database user the site uses to the privileges it needs.
• Review web server logs for anomalous requests to the plugin, and review the site if it was internet-facing while unpatched.
• Monitor for further WP Data Access advisories, as several SQL injection issues have been reported for this plugin.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB CVE-2026-95605 vuldb.com
• OpenCVE CVE-2026-95605 app.opencve.io
• Strix CVE-2026-95605 www.strix.ai
• WPScan WP Data Access wpscan.com
• WordPress.org WP Data Access wordpress.org
• TheHackerWire CVE-2026-95605 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:02.