CVE-2020-36718

Name of the Vulnerable Software and Affected Versions GDPR CCPA Compliance Support plugin for WordPress versions up to and including 2.3

Description The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input njt gdpr allow permissions value. This is a result of PHP Object Injection in the plugin.

Recommendations For versions up to and including 2.3, update to a version that fixes this issue to prevent PHP Object Injection. As a temporary workaround, consider restricting access to the njt gdpr allow permissions input to minimize the risk of exploitation.