{"id":"EM-20261108-HXVP","url":"https://cyber.eventmonitor.net/incident/EM-20261108-HXVP/wp-data-access-vulnerability-cve-2026-118267/","type":"cve","title":"WP Data Access Vulnerability (CVE-2026-118267)","subtitle":"CVE-2026-118267","subject":"CVE-2026-118267","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-08T09:18:33.000Z","firstSignal":"2026-11-07T12:17:43.867Z","lastSignal":"2026-11-09T03:44:23.000Z","updated":"2026-11-09T04:08:44.636Z","revision":1,"life":[{"status":"Born","at":"2026-11-08T09:18:33.000Z","why":"second independent source: C34 ProjectDiscovery nuclei-templates"},{"status":"Developing","at":"2026-11-08T09:18:33.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-07T12:17:43.867Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-08T09:18:33.000Z","what":"Born: second source, C34 ProjectDiscovery nuclei-templates. Page EM-20261108-HXVP created."}],"stages":[{"name":"Disclosed","at":"2026-11-07T12:17:43.867Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-07T12:17:43.867Z","detail":"CVSS 8.1 · EPSS 0.5%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-07T12:17:43.867Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-118267 (CVSS 8.1)","text":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118267"},{"at":"2026-11-08T09:18:33.000Z","source":"C34","sourceName":"ProjectDiscovery nuclei-templates","role":"Research & News","severity":2,"title":"ProjectDiscovery nuclei-templates: Update CVE-2026-118267.yaml","text":"Update CVE-2026-118267.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/commit/894ebbda3daea61a16b9e03cba2a23c3b48ea8b3"},{"at":"2026-11-09T03:44:23.000Z","source":"C34","sourceName":"ProjectDiscovery nuclei-templates","role":"Research & News","severity":2,"title":"ProjectDiscovery nuclei-templates: Merge pull request #17732 from projectdiscovery/CVE-2026-118267","text":"Merge pull request #17732 from projectdiscovery/CVE-2026-118267 CVE-2026-118267 - WP Data Access <= 5.5.89 Incorrect Authorization to Privilege Escalation","url":"https://github.com/projectdiscovery/nuclei-templates/commit/6b835d022bb38ac5152210652e6327c25d9165f1"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-07T12:17:43.867","score":8.1,"severity":"HIGH","desc":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`…","product":"","seen":1794089989894},"kev":null,"epss":{"epss":0.00541,"pct":0.45785,"at":1794197324636},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}