Recherche « peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards »

peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).