CyberRota Analysis
AI-GeneratedThe WP Data Access plugin for WordPress prior to version 5.5.79 is vulnerable due to inadequate validation of column names in an unauthenticated AJAX action, which allows attackers to read arbitrary database columns. This can lead to exposure of sensitive information, including user password hashes, if the affected table is the users table. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data breaches.
Original NVD Description
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.