WP Data Access EUVD-2026-103256

Requires an authenticated account on the target WordPress site at any privilege level, including a subscriber, because the affected plugin action lacks both an authorization check and a CSRF nonce; exploitation is therefore trivial on sites that allow open/self-service user registration and infeasible on sites with registration disabled and no attacker-controlled account. The affected component is the WP Data Access plugin at versions before 5.5.88. The core limiting factor is this authentication-plus-registration prerequisite (PR:L, not PR:N); no specific non-default plugin configuration is stated as required in the description, and no user interaction is needed.

This is a medium-severity SSRF (CWE-918) in the WP Data Access plugin, and the supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N = 5.0) is internally consistent with the description: a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L, satisfiable by a self-registered subscriber), with a changed scope (S:C) reflecting the ability to pivot to internal hosts and only low confidentiality impact (C:L, the attacker reads back the connection outcome). No EPSS score, KEV listing, or POC reference is present in the input, so exploitation likelihood signals are absent rather than contradictory - there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk driver is the missing-authorization + missing-CSRF combination, which lowers the exploitation bar to any authenticated user on sites that permit open/subscriber registration; on sites where registration is closed, exploitation requires an existing account and realistic risk drops. Net: a genuine but moderate priority - worth patching promptly where user registration is open, but not an emergency given low-only confidentiality impact and no exploitation signal.

An attacker registers (or uses) a low-privilege subscriber account on a WordPress site running WP Data Access before 5.5.88, then invokes the vulnerable unauthenticated-of-CSRF action to make the server open a connection to an attacker-chosen host and port - for example an internal metadata endpoint or an internal service on a non-routable address - and reads back the response. No public exploit code is referenced in the available data, so exploitation would require crafting the request from the plugin's action, which is low-complexity given network attack vector and no required user interaction.