PT-2021-23590 · WordPress · Wp Dsgvo Tools

Ramuel Gall · Published 2021-11-05 · Updated 2025-09-19 · CVE-2021-42359

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP DSGVO Tools (GDPR) versions <= 3.1.23

Description The issue allows an attacker to permanently delete an arbitrary post or page on a site by sending an AJAX request with the "action" parameter set to "admin-dismiss-unsubscribe" and the "id" parameter set to the post to be deleted. This is possible due to the lack of a capability check and a nonce check in the 'admin-dismiss-unsubscribe' AJAX action, making it accessible to unauthenticated users. The post type is also not checked when deleting unsubscription requests, further facilitating the attack. Sending such a request would initially move the post to the trash, and repeating the request would result in the permanent deletion of the post.

Recommendations For WP DSGVO Tools (GDPR) versions <= 3.1.23, update to a version greater than 3.1.23 to resolve the issue. As a temporary workaround, consider disabling the 'admin-dismiss-unsubscribe' AJAX action until a patch is available. Restrict access to the AJAX endpoint to minimize the risk of exploitation. Avoid using the id parameter in the affected AJAX request until the issue is resolved.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2021-42359

Affected Products

Wp Dsgvo Tools

References · 4

• 🔥 https://wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42359 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42359 · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/1969129401431228608 · Twitter Post