PT-2026-27328 · WordPress · Wp Dsgvo Tools

Angus Girvan · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-4283

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP DSGVO Tools (GDPR) plugin for WordPress versions through 3.1.38

Description The WP DSGVO Tools (GDPR) plugin for WordPress is susceptible to unauthorized account destruction. The super-unsubscribe AJAX action allows unauthenticated users to bypass the email-confirmation process and immediately trigger irreversible account anonymization by submitting a victim's email address with the process now parameter set to 1. This results in password randomization, username/email overwriting, role stripping, comment anonymization, and the wiping of sensitive user metadata. The required nonce for the request is publicly available on any page containing the [unsubscribe form] shortcode. The vulnerable parameter is process now. The affected API endpoint is the super-unsubscribe AJAX action.

Recommendations Update to version 3.1.39 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-4283

Produtos afetados

Wp Dsgvo Tools

Referências · 14

• https://twitter.com/VolerionSec/status/2036312635164004844 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2036313204956274838 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/trunk/public/shortcodes/super-unsubscribe/unsubscribe-form-action.php#L39 · Nota
• https://twitter.com/0dayPublishing/status/2036309331503624417 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/21389122-cb39-45d1-a889-b830d3a55603?source=cve · Nota
• https://twitter.com/OrizonCyber/status/2036314606881132764 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4283 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?old_path=/shapepress-dsgvo/tags/3.1.38&new_path=/shapepress-dsgvo/tags/3.1.39 · Nota
• https://twitter.com/OrizonCyber/status/2036427829458485495 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/public/shortcodes/super-unsubscribe/unsubscribe-form-action.php#L39 · Nota
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/includes/class-sp-dsgvo-data-collecter.php#L250 · Nota
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/includes/class-sp-dsgvo-ajax-action.php#L69 · Nota
• https://twitter.com/CveFindCom/status/2036317745046835421 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/includes/models/unsubscriber.php#L24 · Nota