The WP Data Access WordPress plugin version 5.5.88 and earlier contains a lack of authorization and CSRF checks on a specific action. An authenticated user, including those with only subscriber privileges, can invoke this action to instruct the server to open outbound connections to arbitrary hosts and ports, including internal network addresses. The server then returns the raw response, allowing the attacker to read the data returned by these connections. This flaw permits Server‑Side Request Forgery that may expose internal services, facilitate data exfiltration, or serve as a pivot into the host network.

WordPress sites that have the WP Data Access plugin installed with a version earlier than 5.5.88 are affected. Any user account that can authenticate to the site—such as a subscriber—can exploit the vulnerability; the failure of CSRF protection means the request can be crafted or run automatically without additional interaction. Users with higher privileges such as administrators are also vulnerable, but the flaw is exploitable by the lowest privileged authenticated role for whom the plugin code runs.

The CVSS score is not published, but the EPSS metric is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating no documented public exploits at this time. However, because the attack requires only authenticated access and no special configuration, the potential for abuse is high in environments where many users have client‑side access. An attacker could target internal services such as intranet pages, database endpoints, or local admin panels, and the attacker can easily read the response, thereby revealing sensitive data or confirming internal network topology. The lack of CSRF protection also allows automated requests from a malicious script running in a user's browser, further easing the attack path.