WP Data Access, CVE-2026-106470

CVE, Research URL: CVE-2026-106470
Home page URL: Security reports for WP Data Access
Application: WP Data Access
Published on: Oct 17, 2026
Research Description: The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.
Affected versions: max 5.5.88.
Status: vulnerable