Security Alert Summary
The WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin (WP Data Access) is affected by an Insecure Direct Object Reference vulnerability (CVE-2026-3235) in all versions up to and including 5.5.68. The issue stems from missing validation in the check_app_access function on a user-controlled key, allowing unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check and data retrieval parameters.
CVE Details
- CVE ID: CVE-2026-3235
- Affected component: WP Data Access 6 App Builder for Tables, Forms, Charts, Maps & Dashboards (vendor: peterschulznl)
- Affected versions: All versions up to and including 5.5.68
- Published: August 26, 2026 11:16:38 AM UTC
- Last modified: August 26, 2026 4:19:05 PM UTC
- CVSS v3.1: Base Score 5.3, Severity MEDIUM, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- Weakness (CWE): CWE-639 (Insecure Direct Object Reference)
Technical Details
This vulnerability is an Insecure Direct Object Reference rooted in missing validation on a user-controlled key used during authorization checks. The plugin performs an authorization check against an app_id, but later retrieves data using a different identifier (cnt_id) without verifying that the container (cnt_id) belongs to the authorized app. Because the ownership of the container is not re-validated, an attacker can supply a crafted identifier and cause the application to return data from protected app containers.
The issue is exposed in the plugin code paths related to application access checks (for example, the check_app_access function) and the container model. Relevant implementation files referenced in the report include WPDA_Apps.php and WPDA_App_Container_Model.php, where the mismatch between the checked parameter (app_id) and the parameter used to fetch data (cnt_id) occurs.
Impact is limited to disclosure of data accessible through the affected app containers. The vulnerability does not indicate modification or deletion of data (integrity and availability impacts are reported as None), but allows read access to information that should be protected by container-level authorization.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner who installs plugins, internal staff who build and manage dashboards, and external contractors who contribute content or maintain forms. If the site uses WP Data Access app containers to store internal reports, customer records, or configuration data, an attacker exploiting this issue could retrieve data from those protected containers without authenticating.
Practical consequences may include limited exposure of internal data such as contact records or user metadata stored in app containers, which could reveal internal user email addresses and increase the risk of targeted phishing or social engineering against staff or contractors. The reported impact is primarily confidentiality-related and assessed as Low, so the likely result is disclosure of specific dataset contents rather than full site compromise.
professional review If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can interact with app containers.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and access logs for unusual behavior related to app or container endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wp-data-access/trunk/WPDataAccess/API/WPDA_Apps.php#L2387
- https://plugins.trac.wordpress.org/browser/wp-data-access/trunk/WPDataAccess/API/WPDA_Apps.php#L2400
- https://plugins.trac.wordpress.org/browser/wp-data-access/trunk/WPDataAccess/Plugin_Table_Models/WPDA_App_Container_Model.php#L50
- https://plugins.trac.wordpress.org/changeset/3477673/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/935f5d76-d63a-4db4-b645-b7961ae8bfaf?source=cve
