What is the CVSS score of CVE-2026-3535?

CVE-2026-3535 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-3535?

The DSGVO Google Web Fonts GDPR WordPress plugin (versions 1.1 and below) contains a critical remote code execution vulnerability that allows unauthenticated attackers to upload malicious files and…

How to fix or mitigate CVE-2026-3535?

Within 24 hours: Identify all WordPress installations using DSGVO Google Web Fonts GDPR plugin version 1.1 or earlier via site inventory and security scanning tools; disable or deactivate the plugin immediately on all affected sites. Within 7 days: Remove the plugin entirely from all WordPress instances; audit web server logs for suspicious file uploads to wp-content and other publicly accessible directories; scan sites for uploaded webshells or backdoors using malware detection tools. Within 30 days: Implement file upload restrictions and security hardening on all WordPress installations; deploy Web Application Firewall rules to block arbitrary PHP uploads; establish ongoing plugin inventory and vulnerability monitoring process.

PHP CVE-2026-3535

EUVD-2026-20104 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-08 Wordfence

GHSA-x9xw-x29g-m332

WordPress PHP RCE File Upload Google

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20104

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

CRITICAL 9.8

DescriptionCVE.org

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the DSGVOGWPdownloadGoogleFonts() function in all versions up to, and including, 1.1. The function is exposed via a wp_ajax_nopriv_ hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

AnalysisAI

Remote code execution in DSGVO Google Web Fonts GDPR WordPress plugin (all versions ≤1.1) allows unauthenticated attackers to upload PHP webshells via arbitrary file upload. The DSGVOGWPdownloadGoogleFonts() function, exposed through wp_ajax_nopriv_ hooks, accepts user-supplied URLs without file type validation and writes content to publicly accessible directories. Exploitation requires the target site to use specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely). CVSS 9.8 Critical reflects network-accessible, unauthenticated attack vector with full system compromise potential. No public exploit identified at time of analysis, though the vulnerability class (CWE-434 unrestricted file upload) is well-understood and commonly weaponized.

Technical ContextAI

This vulnerability stems from insecure implementation of AJAX file handling in WordPress plugin architecture. The DSGVOGWPdownloadGoogleFonts() function is registered via wp_ajax_nopriv_ action hook, which explicitly allows unauthenticated access. The function fetches remote URLs supplied by attackers, parses them as CSS to extract additional URLs, then downloads those resources to the WordPress uploads directory without MIME type verification or extension whitelisting. CWE-434 (Unrestricted Upload of File with Dangerous Type) represents a critical implementation flaw where user-controlled file uploads bypass security controls. The affected product (cpe:2.3:a:mlfactory:dsgvo_google_web_fonts_gdpr) is a GDPR compliance tool designed to locally host Google Fonts, but the font-fetching mechanism becomes an attack surface. The theme-specific exploitation requirement suggests the vulnerable code path activates only when certain WordPress themes are detected, creating conditional exploitability based on environmental factors.

RemediationAI

Immediately disable or uninstall the DSGVO Google Web Fonts GDPR plugin from all WordPress installations. No vendor-released patch identified at time of analysis; WordPress plugin Trac trunk branch continues to contain vulnerable code patterns identical to version 1.1 release. Organizations requiring GDPR-compliant Google Fonts hosting should migrate to alternative plugins with active maintenance and security review history. If plugin removal is not immediately feasible, implement defense-in-depth controls including web application firewall rules blocking POST requests to /wp-admin/admin-ajax.php with action parameter DSGVOGWPdownloadGoogleFonts, restrict wp-uploads directory execution permissions via .htaccess or server configuration, and monitor for unauthorized PHP files in uploads directories. Review server logs for suspicious admin-ajax.php requests originated before remediation. Conduct full filesystem integrity checks on installations running affected plugin versions with compatible themes, searching for recently modified PHP files in publicly accessible directories. Vendor advisory and vulnerability details available at https://www.wordfence.com/threat-intel/vulnerabilities/id/6203ffaf-5efd-4c66-85f0-cc3a05a03084?source=cve.