CVE-2024-43295: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Passionate Programmers B.V. WP Data Access.This issue affects WP Data Access: from n/a through 5.5.7...

CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

Privilege Escalation Vulnerability Patched Promptly in WP Data Access WordPress Plugin

On April 5, 2023 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in WP Data Access, a WordPress plugin that is installed on over 10,000 sites. This flaw makes it possible for an authenticated attacker to grant themselves...

CVE-2023-1874

CVE-2023-1874 affects the WP Data Access WordPress plugin (versions

CVE-2023-1874: Incorrect Privilege Assignment

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiplerolesupdate function. This makes it possible for authenticated attackers, with minimal permissions such as a...

CVE-2021-24866

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backupdate parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion...

Sql injection

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backupdate parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion...

CVE-2021-24866 WP Data Access < 5.0.0 - Admin+ SQL Injection

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backupdate parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion...

CVE-2021-24866

The CVE-2021-24866 entry concerns the WordPress WP Data Access plugin prior to version 5.0.0, where the backup_date parameter is not properly sanitised/escaped before being used in a SQL statement. This causes a SQL injection vulnerability with the potential to delete arbitrary tables as describe...

PT-2021-16344

Name of the Vulnerable Software and Affected Versions: WP Data Access WordPress plugin versions prior to 5.0.0 Description: The issue arises from the improper sanitization and escaping of the backup date parameter, which is used in a SQL statement. This leads to a SQL injection issue, potentially...

CVE-2021-24866: Improper Neutralization of Special Elements used in an SQL Command

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backupdate parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion...