External risk intelligence

Unauthenticated SQL Injection in WP Data Access Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81293

The vulnerability affects a WordPress plugin, which is a type of software commonly deployed as part of public-facing web applications. Because WordPress sites are frequently exposed to the internet to serve content or interact with users, this component is likely to be reachable from the public internet in common deployment patterns.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the WP Data Access component, allowing unauthenticated attackers to execute SQL injection attacks. This could potentially expose sensitive data or compromise system integrity within affected applications. The main concern is confirming relevance and exposure.

Unauthenticated code injection can affect some web applications.
Critical flaw risks data exposure and system integrity.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability through the network without needing any authentication. This allows them to interact with the WP Data Access plugin, potentially leading to unauthorized access to sensitive data and disruption of services.

Reached via network, no authentication required.
Exploits the WP Data Access plugin.
Enables unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows an unauthenticated attacker to inject malicious SQL code into the WordPress database when the WP Data Access plugin is in use and configured in a specific way. This could potentially lead to unauthorized access to or modification of sensitive database information.

Database information could be exposed.
SQL injection via network requests.
Unauthorized database access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in WP Data Access impacts systems where the plugin is deployed and exposed externally. Infrastructure or platform teams typically manage WordPress deployments, but application owners are responsible for the specific plugin's function and risk. The first practical step is to identify all instances of WP Data Access, confirm their reachability and criticality, and then coordinate with the accountable owner to plan remediation.

Identify WP Data Access instances.
Verify external reachability and business impact.
Plan remediation with the accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Data Access plugin?

WP Data Access is a WordPress plugin designed to help users manage, display, and interact with database tables directly from their WordPress dashboard. It serves as a bridge for handling complex data sets without requiring manual SQL queries, making it a common tool for sites that need to present dynamic information or manage structured content.

How does CVE-2026-81293 work as an SQL injection?

This vulnerability falls under the Improper Neutralization of Special Elements used in an SQL Command, or CWE-89. It means the plugin fails to properly filter inputs, allowing an attacker to insert their own SQL commands into the database query. Because of this, the database interprets the malicious input as part of a legitimate instruction, granting unauthorized access to the underlying data.

Do I need to be logged into a site to trigger this flaw?

No, authentication is not required to trigger this vulnerability. An attacker can reach the affected code through standard network requests without having an account or administrative privileges. It is important to note that merely having the plugin installed does not guarantee vulnerability; it must also be configured in a specific way that enables the flawed processing path.

Is my site at risk if it uses WP Data Access?

According to Halo Surface Signal, this plugin is frequently used on public-facing websites, which significantly increases the likelihood that your instance is reachable from the internet. If your WordPress site is exposed to the web, the risk is higher because the vulnerability is reachable over the network without needing user-level access.

When should I take action for this vulnerability?

You should begin by identifying all instances of the WP Data Access plugin within your environment immediately. Once located, verify which instances are accessible from the internet and assess their business impact. Coordinate with the relevant application owner to verify the version in use and plan for the necessary updates or mitigation steps.

References

patchstack.com/database/wordpress/plugin/wp-data-access/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.