A critical vulnerability in the WP Data Access WordPress plugin allows unauthenticated attackers to exfiltrate sensitive database information, including user password hashes.

This vulnerability involves a failure to validate column names within an unauthenticated AJAX action, compounded by an insufficient nonce check. An unauthenticated attacker can leverage this flaw to query and read arbitrary data from database tables associated with front-end forms, potentially exposing sensitive credentials stored in the user table.

The potential for unauthorized access to sensitive database content represents a severe risk to data confidentiality. Because the vulnerability allows the extraction of password hashes, attackers could perform offline cracking to gain administrative access to the WordPress environment. While the CVSS score is 7.5, the ability for an unauthenticated attacker to extract user data elevates the urgency of this remediation.

Immediate Action: Update the WP Data Access plugin to version 5.5.79 or later immediately to apply the necessary input validation and nonce protection.

Proactive Monitoring: Review web server access logs for anomalous, repetitive requests targeting AJAX endpoints or unusual patterns suggesting automated data extraction attempts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block suspicious requests to the plugin's AJAX endpoints if an immediate update is not feasible.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for full user account compromise through password hash theft, this vulnerability poses a significant threat to organizational security. Administrators must prioritize updating the WP Data Access plugin to version 5.5.79. Failure to patch this vulnerability leaves the database open to trivial, automated exfiltration by unauthorized external actors.