CVE-2026-106098

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1060995.3The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only wiCVE-2026-10619.8A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjCVE-2026-106108.5Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.CVE-2026-1061007.1Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions bCVE-2026-1061013.1Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utilsCVE-2026-10610210.0Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in CVE-2026-1061037.1Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generaCVE-2026-1061048.7Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unboundCVE-2026-1061058.4Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.CVE-2026-1061067.1Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/apCVE-2026-1061078.3Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rCVE-2026-1061085.7Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page defi
CVE-2026-106098: Medium severity, CVSS 5.3 | Vulnix