{"id":"CVE-2026-106470","kind":"vulnerability","aliases":["CVE-2026-106470"],"related":[],"title":"WP Data Access WordPress plugin: missing checks let subscribers scan internal hosts","description":"The WP Data Access  WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.","summary":"The WP Data Access WordPress plugin before 5.5.88 has an action that lacks authorisation and CSRF checks. Any logged-in user, including a subscriber, can make the server open connections to arbitrary hosts and ports, including internal ones, and read back the result.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-data-access"],"not_affected_if":["plugin-at-5.5.88-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of WP Data Access in the WordPress admin plugin list or with `wp plugin get wp-data-access --field=version`\n- unknown whether other checks apply; the sources do not say which action is affected","fix":"- Update WP Data Access to `5.5.88` or later\n- unknown whether a workaround exists before updating","status":"open","published_at":"2026-10-17T06:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:30:59+00:00","updated_at":"2026-10-25T04:30:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:30:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Data Access to `5.5.88` or later\n- unknown whether a workaround exists before updating","reach":"network","title":"WP Data Access WordPress plugin: missing checks let subscribers scan internal hosts","impact":"medium","summary":"The WP Data Access WordPress plugin before 5.5.88 has an action that lacks authorisation and CSRF checks. Any logged-in user, including a subscriber, can make the server open connections to arbitrary hosts and ports, including internal ones, and read back the result.","category":"package","nicknames":[],"who_cares":["wordpress","wp-data-access","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Server opens connections to internal hosts and ports, leaking results","analyst_note":"","how_to_check":"- Check the installed version of WP Data Access in the WordPress admin plugin list or with `wp plugin get wp-data-access --field=version`\n- unknown whether other checks apply; the sources do not say which action is affected","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-at-5.5.88-or-later"],"who_is_affected":"Sites running the WP Data Access plugin before `5.5.88` where users with low-privilege accounts such as subscribers can register or log in. The sources do not say whether the flaw is reachable without an account. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3320,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106470':15A,18A '-2026':14A,17A '5.5.88':35B,79C 'access':3A,27B,31B,75C 'action':38B,91C 'allow':92C 'arbitrari':60B,107C 'authent':94C 'authoris':41B,83C 'back':69B,116C 'check':7A,44B,86C 'connect':58B,105C 'csrf':43B,85C 'cve':13A,16A 'data':2A,26B,30B,74C 'host':12A,22B,61B,108C 'includ':50B,64B,111C 'intern':11A,65B,112C 'lack':40B 'let':8A 'log':47B 'logged-in':46B 'make':54B,101C 'miss':6A 'one':66B,88C,113C 'open':57B,104C 'outcom':118C 'packag':19B 'plugin':5A,33B,77C 'port':63B,110C 'read':68B,115C 'result':71B 'scan':10A 'self':21B 'self-host':20B 'server':56B,103C 'subscrib':9A,52B,99C 'user':49B,95C 'wordpress':4A,23B,32B,76C 'wp':1A,25B,29B,73C 'wp-data-access':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Data Access plugin before `5.5.88` where users with low-privilege accounts such as subscribers can register or log in. The sources do not say whether the flaw is reachable without an account. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T06:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106470","severity":null,"published_at":"2026-10-17T06:16:33+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}