CVE-2026-10034

Name of the Vulnerable Software and Affected Versions WP DSGVO Tools (GDPR) versions prior to 3.1.40

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can provide an arbitrary victim email address and trigger immediate Subject Access Request (SAR) processing using the process now and is ajax parameters. This allows the attacker to receive tokenized download links (zip link, pdf link) in the HTTP response, exposing the victim's personal data, such as WordPress account details, comment author names, email addresses, IP addresses, and comment content, without proof of ownership. The security mechanism is further weakened because the nonce used for Cross-Site Request Forgery (CSRF) checks is publicly rendered by the SAR shortcode form and shared among all anonymous visitors, allowing attackers to easily obtain a valid nonce.

Recommendations Update to a version later than 3.1.39.