{"id":"CVE-2026-106470","title":"WP Data Access < 5.5.88 - Subscriber+ SSRF","summary":"The WP Data Access  WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports…","severity":"none","cwe":["CWE-918","CWE-352"],"product":"WP Data Access","affected":["wp_data_access < 5.5.88"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T06:00:13.602Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106470","references":[{"url":"https://wpscan.com/vulnerability/ace39ccf-9fe4-4616-9155-818c10d685dc/"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T07:01:26.050Z","slug":"CVE-2026-106470","body":"## Overview\n\nThe WP Data Access  WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.\n\n## Affected\n\n- `wp_data_access < 5.5.88`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}