{"id":"CVE-2026-106099","revision":"928d58892b8745438a54bd3f2e8ab4c6","records":[{"revision":"928d58892b8745438a54bd3f2e8ab4c6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106099","aliases":[],"title":"WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export","description":"The WP Data Access  WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access  WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.","state":0,"publishedAt":"2026-10-14T06:00:10.037+00:00","modifiedAt":"2026-10-14T13:42:23.713+00:00","affected":[{"ecosystem":"Vendor product","name":"WP Data Access","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WP Data Access\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.5.84\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/65544ed7-d80b-439e-bf8e-73e94041b6bb/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106099","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106099","identifiers":["CVE-2026-106099"]},"retained":false,"historicalAffected":[]}],"coverage":[]}