What is the CVSS score of CVE-2026-4298?

CVE-2026-4298 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

DSGVO All in One CVE-2026-4298

EUVD-2026-42562 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-6h4r-gjpv-q3jc

WordPress Authentication Bypass Google Dsgvo All In One For Wp Wordpress Plugin Mlfactory

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable, low complexity, but PR:L required (Subscriber account); impact limited to integrity of plugin content only, no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 12:10 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

MEDIUM 4.3

DescriptionCVE.org

The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.

AnalysisAI

Missing authorization in the DSGVO All in One for WP plugin (versions up to and including 4.9) allows any authenticated WordPress user with Subscriber-level access or higher to invoke the dsgvo_reset_policy_service_func() function and wipe all customized privacy policy content - cookie notices, Google Analytics policies, Facebook policies, and YouTube policies - back to plugin defaults. The root cause is a complete absence of both WordPress capability checks and nonce verification on a sensitive administrative function that accepts and acts on user-supplied parameters. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication barrier makes this accessible to a wide pool of potential abusers on sites with open user registration.

Technical ContextAI

The affected product is the DSGVO All in One for WP WordPress plugin by mlfactory, identified by CPE cpe:2.3:a:mlfactory:dsgvo_all_in_one_for_wp:*:*:*:*:*:*:*:*. 'DSGVO' is the German acronym for GDPR, and the plugin is designed to help WordPress site operators meet EU data protection regulation requirements by managing cookie consent banners, privacy notices, and third-party analytics disclosure policies. CWE-862 (Missing Authorization) is the root cause: the dsgvo_reset_policy_service_func() function, located at line 1123 of dsgvo_all_in_one_wp.php, processes a reset operation triggered by user-supplied POST parameters without performing any wp_capability check (e.g., manage_options or similar admin-level capability) and without validating a WordPress nonce. WordPress nonces are the standard CSRF-prevention mechanism; their absence means any logged-in user can trigger this function from any context. The function also registers itself in a way that is accessible to low-privilege users, as evidenced by the secondary reference at line 56 where the hook or action registration occurs.

RemediationAI

An upstream fix has been committed to the WordPress plugin repository as changeset 3503821 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3503821%40dsgvo-all-in-one-for-wp&new=3503821%40dsgvo-all-in-one-for-wp); however, no specific patched release version number is independently confirmed from the available input data - administrators should check the plugin's WordPress.org page for a release newer than 4.9 that incorporates this changeset and update immediately. As a compensating control while awaiting a confirmed patched release, administrators can disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent untrusted external parties from obtaining Subscriber accounts and exploiting this flaw. Sites that already have registered subscriber-level users should audit recent activity. Note that disabling registration affects all plugins and features relying on user self-registration, so assess the trade-off against site functionality. Wordfence users with the premium firewall rules subscription may receive a virtual patch via WAF rule prior to a plugin update being available.