CVE-2026-106470: CWE-918 Server-Side Request Forgery (SSRF) in WP Data Access

CVE-2026-106470 is a vulnerability in the WP Data Access WordPress plugin prior to version 5.5.88. The plugin does not enforce authorization or Cross-Site Request Forgery (CSRF) checks on a specific action, enabling any authenticated user to exploit Server-Side Request Forgery (SSRF). This allows the attacker to make the server connect to arbitrary internal or external hosts and ports and retrieve the response data. This could potentially expose internal network resources or sensitive information accessible from the server's network context.

An attacker with any authenticated user role, including low-privileged roles such as subscribers, can exploit this vulnerability to make the server perform arbitrary network requests. This can lead to unauthorized access to internal network services or data that the server can reach, potentially exposing sensitive information or enabling further attacks within the internal network. There is no indication of active exploitation in the wild at this time.

Upgrade the WP Data Access plugin to version 5.5.88 or later, where this vulnerability has been addressed. Since the vulnerability is fixed in 5.5.88, applying this official update is the recommended remediation. No other vendor advisory or patch information is provided, so check the plugin's official release notes or vendor advisory for confirmation and additional guidance.