Executive brief
The WP DSGVO Tools (GDPR) plugin for WordPress, which helps websites comply with European privacy laws, contains a security flaw in its data request feature. An unauthorized person can exploit this to download the full personal data of any user, customer, or administrator simply by knowing their email address. This exposed information includes names, physical addresses, phone numbers, and private comment history, posing a significant privacy and data breach risk.
Technical details
The vulnerability is a missing authorization check (CWE-862) within the 'immediate-processing' path of the Subject Access Request (SAR) feature. By sending a crafted AJAX request to the 'subject-access-request' action with the 'process_now' parameter enabled, an unauthenticated attacker can bypass standard verification steps. The server responds with a direct download token for the requested email address. This token can then be used via the 'download-subject-access-request' action to retrieve a ZIP or PDF export containing sensitive PII, including names, addresses, and phone numbers. The issue is fixed in version 3.1.40.
Affected products
- shapepress-dsgvo WP DSGVO Tools (GDPR) < 3.1.40
Timeline
- 2026-06-18: disclosed: Publicly published by WPScan
- 2026-06-18: patched: Fix available in version 3.1.40
- 2026-07-09: advisory: CVE published to NVD dataset