PT-2026-27328 · WordPress · Wp Dsgvo Tools

Angus Girvan · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-4283

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP DSGVO Tools (GDPR) plugin for WordPress versions through 3.1.38

Description The WP DSGVO Tools (GDPR) plugin for WordPress is susceptible to unauthorized account destruction. The super-unsubscribe AJAX action allows unauthenticated users to bypass the email-confirmation process and immediately trigger irreversible account anonymization by submitting a victim's email address with the process now parameter set to 1. This results in password randomization, username/email overwriting, role stripping, comment anonymization, and the wiping of sensitive user metadata. The required nonce for the request is publicly available on any page containing the [unsubscribe form] shortcode. The vulnerable parameter is process now. The affected API endpoint is the super-unsubscribe AJAX action.

Recommendations Update to version 3.1.39 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4283

Affected Products

Wp Dsgvo Tools

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-4283 · Security Note
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/public/shortcodes/super-unsubscribe/unsubscribe-form-action.php#L39 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/21389122-cb39-45d1-a889-b830d3a55603?source=cve · Note
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/includes/models/unsubscriber.php#L24 · Note
• https://twitter.com/OrizonCyber/status/2036314606881132764 · Twitter Post
• https://twitter.com/VolerionSec/status/2036312635164004844 · Twitter Post
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/includes/class-sp-dsgvo-ajax-action.php#L69 · Note
• https://twitter.com/0dayPublishing/status/2036309331503624417 · Twitter Post
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/tags/3.1.38/includes/class-sp-dsgvo-data-collecter.php#L250 · Note
• https://plugins.trac.wordpress.org/browser/shapepress-dsgvo/trunk/public/shortcodes/super-unsubscribe/unsubscribe-form-action.php#L39 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=/shapepress-dsgvo/tags/3.1.38&new_path=/shapepress-dsgvo/tags/3.1.39 · Note
• https://twitter.com/TheHackerWire/status/2036313204956274838 · Twitter Post
• https://twitter.com/CveFindCom/status/2036317745046835421 · Twitter Post