WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

Overview

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (wpda/app/update, wpda/app/delete, wpda/app/insert) passing the attacker-supplied key and val parameters directly to $wpdadb->update, $wpdadb->delete, and $wpdadb->insert without enforcing the container's row-filter (defaultWhere) or per-column allow-list (isSelected) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the user_pass field of the WordPress administrator account in wp_users — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.

Affected

• wp_data_access_app_builder_for_tables_forms_dashboards_charts_maps <= 5.5.89

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.