CVE-2026-4298

Name of the Vulnerable Software and Affected Versions DSGVO All in one for WP versions prior to 5.0

Description The plugin contains a missing authorization flaw within the dsgvo reset policy service func() function. The function fails to perform capability checks and nonce verification when processing user-supplied parameters to reset plugin options. This allows authenticated users with Subscriber-level access or higher to reset customized privacy policy content, including cookie notices and policies for Google Analytics, Facebook, and YouTube, back to their default values.

Recommendations Update to a version newer than 4.9. As a temporary mitigation, restrict access to the dsgvo reset policy service func() function.