CVE-2026-42665
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
There is an unauthenticated SQL Injection vulnerability in WP Data Access versions <= 5.5.70.
Risk Assessment
An attacker could exploit this vulnerability to gain access to the database, potentially exposing sensitive information.
Recommendation
It is recommended to update WP Data Access to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP Data Access
See all- CVE-2026-93621High
The WP Data Access plugin versions 5.5.84 and earlier contain an unauthenticated SQL Injection vulnerability. A remote attacker can exploit this to execute unauthorized queries against the database.
- CVE-2026-66595Medium
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
- CVE-2026-81293Critical
An unauthenticated SQL Injection vulnerability was detected in WP Data Access versions up to 5.5.81. This vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-73344Medium
Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.
- CVE-2026-66663High
Cross Site Scripting (XSS) vulnerability in WP Data Access plugin up to version 5.5.79, allowing an unauthenticated attacker to inject malicious scripts into pages.
Original NVD description (English source)
Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS