EUVD-2026-42509
GHSA-m267-7fgq-g6v7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no privileges or interaction; confidentiality impact rated Low per-request despite automation potential enabling bulk PII harvest.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.
AnalysisAI
Unauthenticated personal data exfiltration in WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 allows any remote attacker to download the full GDPR personal data export of any user, customer, or commenter by supplying only their email address. The plugin's data subject access request (DSAR) immediate-processing path omits an authorization check, converting a legally mandated privacy feature into a privacy breach vector. A publicly available POC exploit exists, SSVC confirms the attack is automatable, and a vendor patch has been released at version 3.1.40.
Technical ContextAI
The WP DSGVO Tools (GDPR) plugin implements the EU GDPR Article 15 'right of access' obligation for WordPress sites, exposing a data subject access request (DSAR) endpoint that, when triggered, generates a structured personal data export for a given account. The plugin offers two processing modes: a standard deferred path (with email verification) and an 'immediate-processing' path. The authorization control - verifying that the requester is entitled to the data - is absent on the immediate path, reducing identity verification to mere email address possession. CPE cpe:2.3:a:unknown:wp_dsgvo_tools_(gdpr):*:*:*:*:*:*:*:* covers all versions up to the fix. No CWE is assigned by NVD, but the root cause maps to CWE-862 (Missing Authorization): the plugin performs authentication (PR:N per CVSS) for the endpoint but entirely omits the authorization step that gates data retrieval to the owner of the requested record.
RemediationAI
Update the WP DSGVO Tools (GDPR) plugin to version 3.1.40 or later, which contains the vendor-released authorization fix on the DSAR immediate-processing path. The patch is confirmed available per WPScan advisory (https://wpscan.com/vulnerability/49170650-0006-4f3b-90f4-f8bb176beb7b/) and EUVD-2026-42509. If immediate update is not feasible, disable the plugin's immediate-processing DSAR mode (reverting to the email-verified deferred path) if the plugin exposes that configuration toggle - this preserves GDPR compliance while removing the unauthenticated attack surface, at the trade-off of less instant user-data delivery. As a harder compensating control, a WAF rule blocking unauthenticated POST requests to the plugin's DSAR processing endpoint can interrupt exploitation but requires identifying the exact endpoint path and may break legitimate GDPR functionality for end users. Neither workaround substitutes for patching.
More in Wp Dsgvo Tools Gdpr
View allThe WP DSGVO Tools (GDPR) plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticat
Unauthenticated personal data exfiltration in WP DSGVO Tools (GDPR) plugin for WordPress (≤3.1.39) allows any remote att
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today