GDPR Data Request EUVD-2026-95706

Exploitation requires that the targeted WordPress site runs GDPR Data Request Form plugin version 1.7.1 or earlier, which lacks a CSRF nonce on the update handler for one specific setting. A site administrator must have an active authenticated session AND must be socially engineered into clicking an attacker-controlled link or visiting a malicious page (UI:R). Limiting factors: impact is confined to changing that single setting with no confidentiality or availability effect; the attack cannot run unattended because it depends on admin interaction and an existing logged-in session, making it targeted rather than mass-exploitable.

This is a low-to-moderate real-world risk despite the medium CVSS 4.3 score, and the signals are internally consistent. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) describes a network-reachable but user-interaction-dependent CSRF flaw: the attacker needs no privileges of their own (PR:N) but must trick an authenticated administrator into acting (UI:R), and the only impact is limited integrity (I:L) - no confidentiality or availability loss. A publicly available exploit exists (WPScan), which raises the reproducibility of the issue, but POC availability is not the same as active exploitation. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of widespread or automated exploitation; the attack is inherently targeted because it hinges on social-engineering a specific logged-in admin. No SSVC decision data was supplied. Net assessment: a genuine but constrained CSRF weakness affecting a single setting, appropriate for routine patching rather than emergency prioritization.

An attacker hosts or emails a page containing a forged request that targets the plugin's unprotected settings endpoint. While logged into WordPress, a site administrator is lured into clicking the link, and their browser silently submits the request, changing the affected plugin setting without the admin's intent. A public proof-of-concept from WPScan demonstrates the forged request.