{"id":"CVE-2026-106098","published":"2026-10-14T07:17:00.820","lastModified":"2026-10-14T16:14:02.800","description":"The WP Data Access  WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/f062a098-c00c-49f8-a32a-58b18ebcebe2/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}