What is the CVSS score of CVE-2026-4283?

CVE-2026-4283 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4283?

A critical vulnerability in the WP DSGVO Tools plugin enables attackers to permanently destroy user accounts without authentication, affecting any WordPress installation using this plugin.

How to fix or mitigate CVE-2026-4283?

Within 24 hours: Inventory all WordPress installations using WP DSGVO Tools and assess user exposure; notify affected users of potential account compromise risk. Within 7 days: Disable the WP DSGVO Tools plugin entirely or implement aggressive WAF rules to block GDPR anonymization endpoints; engage plugin vendor for patch timeline and security updates. Within 30 days: Migrate to a patched version once available, or evaluate alternative GDPR compliance plugins with active security maintenance; conduct incident review and user account audit for evidence of exploitation.

WordPress CVE-2026-4283

EUVD-2026-14735 CRITICAL

Missing Authorization (CWE-862)

2026-03-24 Wordfence

WordPress Authentication Bypass

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 24, 2026 - 05:15 euvd

EUVD-2026-14735

Analysis Generated

Mar 24, 2026 - 05:15 vuln.today

CVE Published

Mar 24, 2026 - 04:27 nvd

CRITICAL 9.1

DescriptionCVE.org

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the super-unsubscribe AJAX action accepting a process_now parameter from unauthenticated users, which bypasses the intended email-confirmation flow and immediately triggers irreversible account anonymization. This makes it possible for unauthenticated attackers to permanently destroy any non-administrator user account (password randomized, username/email overwritten, roles stripped, comments anonymized, sensitive usermeta wiped) by submitting the victim's email address with process_now=1. The nonce required for the request is publicly available on any page containing the [unsubscribe_form] shortcode.

AnalysisAI

The WP DSGVO Tools (GDPR) plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticated attackers to permanently destroy any non-administrator user account. Attackers can trigger immediate and irreversible account anonymization (randomizing passwords, overwriting usernames/emails, stripping roles, anonymizing comments, and wiping sensitive metadata) by submitting a victim's email address with a publicly available nonce. All versions up to and including 3.1.38 are affected, with a CVSS score of 9.1 indicating critical severity.

Technical ContextAI

This vulnerability affects the WP DSGVO Tools (GDPR) plugin (CPE: cpe:2.3:a:legalweb:wp_dsgvo_tools_(gdpr):*:*:*:*:*:*:*:*), a WordPress plugin designed to help site owners comply with European GDPR data protection regulations. The root cause is CWE-862 (Missing Authorization), specifically in the 'super-unsubscribe' AJAX action handler found in the class-sp-dsgvo-ajax-action.php file. The vulnerable code accepts a 'process_now' parameter from unauthenticated requests without proper authorization checks, bypassing the intended email confirmation workflow that should gate destructive account operations. The nonce protection mechanism is ineffective because the nonce value is publicly exposed on any page displaying the [unsubscribe_form] shortcode, making it trivial for attackers to construct valid requests. When exploited, the vulnerability triggers the unsubscriber model and data collector classes to perform irreversible account anonymization operations designed for legitimate GDPR data deletion requests.

RemediationAI

Immediately upgrade the WP DSGVO Tools (GDPR) plugin to version 3.1.39 or later, which addresses this vulnerability as indicated by the changeset reference at https://plugins.trac.wordpress.org/changeset?old_path=/shapepress-dsgvo/tags/3.1.38&new_path=/shapepress-dsgvo/tags/3.1.39. Site administrators should verify the update through the WordPress plugin management interface and confirm they are running the patched version. Until patching is completed, consider temporarily disabling the plugin if GDPR unsubscribe functionality is not immediately critical, or remove all instances of the [unsubscribe_form] shortcode from public-facing pages to prevent nonce exposure. Review user account logs for suspicious anonymization events that may indicate prior exploitation. Detailed vulnerability information and code references are available through Wordfence Threat Intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/21389122-cb39-45d1-a889-b830d3a55603?source=cve.