WP Data Access Plugin up to 5.5.87 on WordPress server-side request forgery

Summaryinfo

A vulnerability has been found in WP Data Access Plugin up to 5.5.87 and classified as critical. The impacted element is an unknown function. The manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2026-106470. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in WP Data Access Plugin up to 5.5.87. This issue affects an unknown part. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.

It is possible to read the advisory at wpscan.com. The identification of this vulnerability is CVE-2026-106470 since 10/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 5.5.88 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-103256). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• WP Data Access Plugin

Version

• 5.5.0
• 5.5.1
• 5.5.2
• 5.5.3
• 5.5.4
• 5.5.5
• 5.5.6
• 5.5.7
• 5.5.8
• 5.5.9
• 5.5.10
• 5.5.11
• 5.5.12
• 5.5.13
• 5.5.14
• 5.5.15
• 5.5.16
• 5.5.17
• 5.5.18
• 5.5.19
• 5.5.20
• 5.5.21
• 5.5.22
• 5.5.23
• 5.5.24
• 5.5.25
• 5.5.26
• 5.5.27
• 5.5.28
• 5.5.29
• 5.5.30
• 5.5.31
• 5.5.32
• 5.5.33
• 5.5.34
• 5.5.35
• 5.5.36
• 5.5.37
• 5.5.38
• 5.5.39
• 5.5.40
• 5.5.41
• 5.5.42
• 5.5.43
• 5.5.44
• 5.5.45
• 5.5.46
• 5.5.47
• 5.5.48
• 5.5.49
• 5.5.50
• 5.5.51
• 5.5.52
• 5.5.53
• 5.5.54
• 5.5.55
• 5.5.56
• 5.5.57
• 5.5.58
• 5.5.59
• 5.5.60
• 5.5.61
• 5.5.62
• 5.5.63
• 5.5.64
• 5.5.65
• 5.5.66
• 5.5.67
• 5.5.68
• 5.5.69
• 5.5.70
• 5.5.71
• 5.5.72
• 5.5.73
• 5.5.74
• 5.5.75
• 5.5.76
• 5.5.77
• 5.5.78
• 5.5.79
• 5.5.80
• 5.5.81
• 5.5.82
• 5.5.83
• 5.5.84
• 5.5.85
• 5.5.86
• 5.5.87

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion