# CVE-2026-106470: WP Data Access WordPress plugin SSRF in action

Source: https://junglewise.ai/threats/cve-2026-106470-the-wp-data-access-wordpress-plugin-before-5-5-88-does-not-have  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-106470 · Severity: info · Published 2026-10-17

WP Data Access is a WordPress plugin that manages database access and operations. The plugin fails to properly validate user permissions and requests in one of its features, allowing any logged-in user—even those with minimal privileges like subscribers—to make the server initiate connections to arbitrary hosts and ports, including internal systems, potentially exposing sensitive information or facilitating lateral movement attacks.

Technologies: [WP Data Access](https://junglewise.ai/threats/technologies/wp-data-access). Vendors: [WP Data Access](https://junglewise.ai/threats/vendors/wp-data-access).

## Quick answers

**Is CVE-2026-106470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106470 being exploited in the wild.

**How severe is CVE-2026-106470?** Informational severity, published 17 October 2026.

**Which products and versions are affected?** WP Data Access before 5.5.88.

**Is there a fix for CVE-2026-106470?** Yes: fixed in 5.5.88. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106470 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-106470?** Check whether you run WP Data Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.5.88

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the plugin due to missing authorization and CSRF checks in one of its actions. Authenticated users with subscriber-level privileges can exploit this to make the server connect to arbitrary hosts and ports (including internal/private systems) and retrieve the response. The vulnerability is fixed in version 5.5.88.

## Affected products

- WP Data Access WP Data Access before 5.5.88

## Timeline

- 2026-10-15: disclosed
- 2026-10-17: advisory

## References

- [https://wpscan.com/vulnerability/ace39ccf-9fe4-4616-9155-818c10d685dc/](https://wpscan.com/vulnerability/ace39ccf-9fe4-4616-9155-818c10d685dc/)

## Related threats

- [WP Data Access plugin sensitive information exposure via REST API](https://junglewise.ai/threats/cve-2026-110023-the-wp-data-access-app-builder-for-tables-forms-dashboards)
- [WP Data Access SQL injection](https://junglewise.ai/threats/cve-2026-93621-unauthenticated-sql-injection-in-wp-data-access-5-5-84-versions)
- [WP Data Access SQL Injection](https://junglewise.ai/threats/cve-2026-81293-wp-data-access-sql-injection)
- [WP Data Access broken access control authentication bypass](https://junglewise.ai/threats/cve-2026-66595-wp-data-access-broken-access-control-authentication-bypass)
- [WP Data Access unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-42665-wp-data-access-unauthenticated-sql-injection)