Beveiligingsadvies

CVE-2026-3235

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-08-26 11:05:44

Laatst bijgewerkt 2026-08-28 18:35:57

Toegewezen door Wordfence

CVSS-score 5.3

Status PUBLISHED

Beschrijving

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).

← Alle CVE's bekijken Bekijk op cve.org ↗