CVE-2026-10034: WP DSGVO Tools GDPR Plugin Authorization Bypass Exposes Personal Data

Technical summary

CVE-2026-10034 is an authorization bypass vulnerability in WP DSGVO Tools (GDPR) versions up to 3.1.39 caused by improper authorization checks on the SAR (Subject Access Request) processing endpoint. The vulnerability stems from two compounding weaknesses: (1) insufficient verification that the requester is authorized to generate SARs for a given email address, and (2) reliance on a static, publicly-rendered nonce value that is shared among all unauthenticated users. By crafting a request with arbitrary victim email addresses and manipulating the process_now and is_ajax parameters, an attacker bypasses both authorization and CSRF protections. The server responds with tokenized download URLs (zip_link, pdf_link) that grant direct access to the victim's data archive, including WordPress account metadata, comment details, email addresses, IP addresses, and content history. This maps to CWE-862 (Missing Authorization).

Business impact

Organizations and individuals relying on the WP DSGVO Tools plugin for GDPR compliance face exposure of sensitive personal data (email addresses, IP addresses, account names, comment history) for any WordPress user in their system. The vulnerability undermines the plugin's core function—managing data subject access requests securely—and creates regulatory liability. Attackers can mass-enumerate and download personal data without authorization, increasing risk of identity theft, spam campaigns, and privacy breaches. For multi-site WordPress installations, the blast radius can be significant. The lack of any authentication requirement means even low-resource attackers can exploit this at scale.

Affected systems

The WP DSGVO Tools (GDPR) plugin for WordPress is affected in all versions up to and including 3.1.39. Any WordPress site with this plugin installed and the SAR feature enabled is vulnerable, regardless of whether the SAR shortcode is publicly visible or protected by user registration. The vulnerability does not require the attacker to be a registered WordPress user or have any site access privileges.

Exploitability

This vulnerability has a CVSS 3.1 score of 5.3 (MEDIUM severity) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Network accessibility and low attack complexity make it straightforward to exploit. No user interaction is required, and no special privileges are needed—any unauthenticated attacker can craft requests. The primary difficulty (obtaining a valid nonce) is eliminated by the fact that the nonce is publicly rendered in the HTML form and reused across all visitors, requiring only one page fetch to retrieve it. While the leaked data is limited to information already stored in the WordPress environment (not involving integrity or availability impact), the confidentiality breach is direct and immediate.

Remediation

Sites running WP DSGVO Tools (GDPR) should update to a patched version beyond 3.1.39. Verify the latest available version in the WordPress plugin repository and test in a staging environment before deployment. During the interim, administrators should consider temporarily disabling the SAR shortcode form or restricting access via .htaccess/firewall rules if patching cannot be applied immediately. Review WordPress audit logs for suspicious SAR requests (look for multiple distinct email addresses being processed in rapid succession from single IP addresses) to identify potential exploitation.

Patch guidance

Apply the latest available version of WP DSGVO Tools (GDPR) from the official WordPress plugin repository. Verify against the vendor's advisory for confirmation of the fix and any migration steps. After patching, test the SAR functionality with a non-admin account to confirm proper authorization enforcement is in place. Clear any cached nonce values in your plugin cache if applicable. No data restoration is needed; this patch addresses forward exploitation only.

Detection guidance

Monitor for HTTP requests to the plugin's SAR processing endpoint (typically wp-admin/admin-ajax.php with action=process_now and is_ajax=1) that originate from unauthenticated sessions or IPs making repeated requests with different email address parameters. Check WordPress access logs for patterns such as: (1) rapid sequential requests from a single source with varying user email addresses, (2) successful SAR processing for users not matching the requesting IP or browser fingerprint, (3) download link generation without corresponding user authentication. Enable logging of nonce values if your WAF/logging stack supports it. Investigate any unexpected ZIP or PDF download requests for user data exports.

Why prioritize this

Although rated MEDIUM (CVSS 5.3), this vulnerability warrants prompt remediation because it directly exposes personally identifiable information regulated under GDPR and similar privacy frameworks. The trivial exploitability (no authentication, no user interaction, publicly visible CSRF bypass) and lack of KEV inclusion should not lead to complacency—the attack surface is broad and the regulatory/reputational damage from a breach is substantial. Organizations with large user bases or sensitive audiences should prioritize patching within their standard patching cadence (typically within 30 days of patch availability).

Risk score, explained

The CVSS 5.3 MEDIUM score reflects that the vulnerability results in confidentiality loss with no integrity or availability impact, limited to the scope of the affected system. However, the real-world severity is elevated by: (1) zero authentication requirement, (2) trivial CSRF bypass via public nonce reuse, (3) direct exposure of regulated personal data, and (4) potential for large-scale automated exploitation. Organizations handling personal data subject to privacy regulations should treat this as a high-priority item within their context, even if the base CVSS is moderate.

Frequently asked questions