CVE-2026-106470
WP Data Access < 5.5.88 - Subscriber+ SSRF
Unknown WP Data Access
CVSS
5.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.11%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.5.88WP Data AccessCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.
Text from CVE List
Affected versions 1
- WP Data Accessaffected: all versions before 5.5.88CVE List