Live › vulnerability › CVE-2026-106470
Go to dashboardThe WP Data Access WordPress plugin before 5.5.88 has an action that lacks authorisation and CSRF checks. Any logged-in user, including a subscriber, can make the server open connections to arbitrary hosts and ports, including internal ones, and read back the result.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP Data Access plugin before where users with low-privilege accounts such as subscribers can register or log in. The sources do not say whether the flaw is reachable without an account. Sites that do not run this plugin can skip it.
5.5.88No product ranges from the sources yet.
wp plugin get wp-data-access --field=version5.5.88 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.
This page as .md · .json · in your agent: get_signal("CVE-2026-106470")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.