Complianz EUVD-2026-48109

No special conditions required beyond the plugin being installed and active - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms remote unauthenticated exploitation against default configurations of WordPress sites running Complianz 7.5.0 or earlier. The available data does not describe any specific feature flag, non-default configuration setting, or deployment mode as a prerequisite. Limiting factors: the target site must have the Complianz plugin installed and network-accessible (standard for public-facing WordPress deployments); the specific endpoint returning sensitive data must not be blocked by server-level controls such as WAF rules or IP restrictions; and the unchanged scope (S:U) means exploitation impact is confined to data accessible within the plugin's own context rather than broader WordPress core compromise.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible, zero-prerequisite information disclosure with limited confidentiality impact (C:L) and no integrity or availability effects. The AV:N/AC:L/PR:N/UI:N vector is a high-concern signal: the attack requires no credentials, no complexity, and no user interaction, making automated mass scanning across WordPress installations entirely feasible at scale. However, the C:L rating constrains the raw impact to partial data exposure rather than full system compromise. No EPSS score was provided in the available intelligence, limiting probabilistic exploitation probability assessment. No KEV listing exists and no public POC has been identified at time of analysis. The real-world risk is amplified by the plugin's function - GDPR compliance plugins handle personal data and consent records, so even partial exposure may trigger regulatory notification obligations under GDPR Article 33, elevating business impact well beyond what CVSS captures. Overall: prioritize patching given the zero-authentication bar and the sensitivity of the plugin's data domain, despite the moderate CVSS score.

An unauthenticated attacker sends a crafted HTTP GET request to a publicly accessible Complianz plugin endpoint on a target WordPress site, with no credentials or session tokens required. The server responds with sensitive data - potentially visitor consent records, personal data processing configurations, or compliance settings - which the attacker harvests directly from the response body. No public exploit code has been identified at time of analysis, but the zero-complexity attack vector makes this trivially executable with standard HTTP tooling or automated scanners targeting WordPress plugin fingerprints.