Vulnerability · Published Oct 14, 2026 · Assigned by WPScan

CVE-2026-106099WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export

Medium 5.3

In plain English

A medium-severity information exposure in WP Data Access from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 80.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Data Access	0 – before 5.5.84

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/65544ed7-d80b-439e-bf8e-73e94041b6bb/ exploit, vdb-entry, technical-description