A WordPress plugin used to build data tables, forms and dashboards has an authorization flaw that lets a low-privilege account rewrite an administrator password and take the site.
What happened
The flaw is tracked as CVE-2026-118267 and affects WP Data Access through version 5.5.89. Its write endpoints for app update, delete and insert pass the attacker-supplied key and val parameters straight to the database layer without applying the container row filter and per-column allow-list that the plugin's read endpoints do enforce.
That gap allows writes to rows and columns outside the configured restrictions. In the worst case the target is the user_pass field in the WordPress users table, which hands the attacker an administrator login. Wordfence rates it CVSS 8.1, and it is fixed in 5.5.90.
The anonymous path requires a specific configuration: a published Data App whose REST authorization is set to anonymous and whose container has update, delete or insert transactions enabled. On a default install that combination does not exist, and the flaw needs a Subscriber-level account instead.
Who is affected
- Any site running WP Data Access 5.5.89 or earlier.
- Sites that published a Data App allowing insert, update or delete to Subscribers or anonymous visitors, which is an advertised use case of the plugin.
- Sites whose Data Apps point at wp_users or other tables holding credentials and personal data.
- Multisite and agency-managed installs where one weak site shares a hosting account with client sites.
What to do now
Update WP Data Access to 5.5.90 or later, then confirm no administrator account or password changed while the old version was live.
- Run the plugin update and verify the installed version rather than trusting the update notice.
- Open each Data App and remove write transactions for Subscriber and anonymous roles. Set REST authorization to authenticated unless public forms genuinely require otherwise.
- Audit administrator accounts, their last password change and any new user with elevated rights.
- If you cannot patch immediately, disable write transactions on every public-facing Data App.
- Check logs for POST requests to the plugin's app update, delete and insert endpoints from unexpected sources.
What this means for South African businesses
The exposure is narrower than the score suggests, because the dangerous anonymous path needs a Data App deliberately opened for public writes. Most South African sites running this plugin will not have that configuration, and should not panic about it.
The realistic risk is the authenticated path: a single Subscriber account, easily obtained through open registration or a compromised mailbox, is enough to reset the administrator password silently. My judgement is that this is the kind of takeover an SME site owner never notices, because nothing breaks, no page goes down, and the new administrator looks like any other user.
The vulnerability record and technical detail are published by Wordfence Intelligence.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.