CyberRota Analysis
AI-GeneratedThe WP Data Access plugin for WordPress is susceptible to Insecure Direct Object Reference, allowing unauthenticated attackers to access sensitive data from protected app containers due to insufficient validation on user-controlled keys. This vulnerability arises from a mismatch in authorization checks, potentially exposing user data. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).