CVE-2026-106470: WP Data Access < 5.5.88 - Subscriber+ SSRF

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with only the Subscriber role. An attacker must be able to log in to the affected WordPress site.

Q: What access could an attacker gain through exploitation?

The attacker can cause the server to connect to arbitrary hosts and ports, including internal network services, and read the connection outcome. This can expose information about services reachable from the WordPress server.

Q: Are installations running version 5.5.88 affected?

The issue affects WP Data Access versions before 5.5.88. The provided information does not identify any other affected version ranges.

Published Oct 17, 2026

Updated

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.

Affected Software

1 affected component

WP Data Access WP Data Access<5.5.88

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with only the Subscriber role. An attacker must be able to log in to the affected WordPress site.

What access could an attacker gain through exploitation?

The attacker can cause the server to connect to arbitrary hosts and ports, including internal network services, and read the connection outcome. This can expose information about services reachable from the WordPress server.

Are installations running version 5.5.88 affected?

The issue affects WP Data Access versions before 5.5.88. The provided information does not identify any other affected version ranges.

CVE-2026-106470: WP Data Access < 5.5.88 - Subscriber+ SSRF

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain through exploitation?

Are installations running version 5.5.88 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain through exploitation?

Are installations running version 5.5.88 affected?