The WordPress plugin WP Data Access, in versions earlier than 5.5.88, is missing both authorization and CSRF checks on one of its actions. When triggered, the action causes the server to initiate outbound connections to arbitrary hosts and ports—including internal addresses—and then returns the raw response back to the requester. This flaw allows an authenticated user, such as a subscriber, to perform Server‑Side Request Forgery and obtain data from other services that the web server can reach.

WordPress sites that have the WP Data Access plugin installed with a version earlier than 5.5.88 are affected. Any authenticated user, including those with subscriber role, can exploit the vulnerability because the plugin’s code runs for all authenticated accounts.

The CVSS score of 5.0 indicates a moderate severity. The EPSS score of < 1 % suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, and no publicly documented exploits are known. The lack of CSRF protection, inferred from the description, means that the request could be crafted or executed automatically without additional user interaction, potentially making the attack easier for an attacker who gains any legitimate authenticated session.