EUVD-2026-37988
GHSA-8gvx-hvcr-5q8c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible with no authentication or user interaction; C:L rather than C:H because each exploit yields targeted data for one known victim email, not systemic access.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.39. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to supply an arbitrary victim email address and trigger immediate SAR processing via the process_now and is_ajax parameters, receiving tokenized download links (zip_link, pdf_link) in the HTTP response that expose the victim's personal data - including WordPress account details, comment author names, email addresses, IP addresses, and comment content - without any proof of ownership. The nonce used for the CSRF check is publicly rendered by the SAR shortcode form and is shared across all anonymous visitors, meaning any unauthenticated attacker can trivially obtain a valid nonce and bypass this gate entirely.
AnalysisAI
Unauthenticated personal data exfiltration in WP DSGVO Tools (GDPR) plugin for WordPress (≤3.1.39) allows any remote attacker to trigger immediate Subject Access Request (SAR) fulfillment for an arbitrary victim email, receiving tokenized download links in the HTTP response that expose WordPress account details, comment history, email addresses, and IP addresses. The plugin's CSRF nonce - the only gate protecting this action - is publicly rendered by the SAR shortcode form and shared across all anonymous visitors, rendering it entirely ineffective as an access control mechanism. No active exploitation is confirmed (not in CISA KEV) and no public POC is confirmed at time of analysis, though the Wordfence advisory includes direct source code references identifying the exact vulnerable code paths.
Technical ContextAI
The vulnerability resides in the Subject Access Request (SAR) shortcode handler of the WP DSGVO Tools plugin (CPE: cpe:2.3:a:legalweb:wp_dsgvo_tools_(gdpr):*:*:*:*:*:*:*:*), a GDPR compliance plugin developed by Legalweb for WordPress. The root cause is CWE-862 (Missing Authorization): the plugin's AJAX dispatcher in class-sp-dsgvo-ajax-action.php (line 70) and subject-access-request-action.php (lines 24, 40, 47) processes SAR requests without verifying that the requestor has any ownership or authorization over the specified email address. The is_ajax and process_now parameters trigger immediate SAR fulfillment, bypassing the normal manual-review workflow. The CSRF nonce embedded in the shortcode form is session-agnostic - generated identically for all anonymous visitors - so it provides no meaningful authorization signal. The resulting SAR package (zip_link and pdf_link) is a GDPR-mandated personal data export containing account details, comment content, IP addresses, and email addresses.
RemediationAI
An upstream fix changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574362%40shapepress-dsgvo&new=3574362%40shapepress-dsgvo), but a specific patched tagged release version is not confirmed in the available data - administrators should verify the current version in the WordPress plugin directory and update to any release beyond 3.1.39 once confirmed patched. Until a verified patched release is deployed, the most effective compensating control is to remove or unpublish any pages or posts that embed the Subject Access Request shortcode, which eliminates the public attack surface entirely; the trade-off is that legitimate GDPR data subject access requests cannot be self-served by users during this period and must be handled manually. As a secondary stopgap, WAF rules can be applied to block POST requests containing both the process_now and is_ajax parameters targeting the wp-admin/admin-ajax.php endpoint for this plugin's action, though this is not a substitute for patching.
More in Wp Dsgvo Tools Gdpr
View allUnauthenticated personal data exfiltration in WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 allows any remote att
The WP DSGVO Tools (GDPR) plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticat
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today