Executive brief
The GDPR Framework By Data443 is a WordPress plugin that manages GDPR compliance, including consent records and data subject requests. Before version 2.4.0, the plugin fails to verify user identity when recording cookie-consent choices and privacy requests, allowing attackers to impersonate users, forge acceptance/denial records, and submit fake data deletion requests—potentially disrupting compliance records and overwhelming site administrators with fraudulent requests.
Technical details
The vulnerability is an authorization bypass affecting the plugin's AJAX endpoints (gdpr_add_consent_accept_cookies, gdpr_add_consent_deny_cookies, donot_sell_save_post). The root cause is improper verification of the data subject's identity: the plugin relies solely on a broken Referer header check and uses an attacker-controllable gdpr_key cookie parameter to identify users, with no nonce validation, capability checks, or rate limiting. An unauthenticated attacker can forge consent records for arbitrary email addresses, flip consent status from accept to deny, and create unlimited entries in the admin privacy-request queue. No authentication or user interaction is required; the attack vector is network-based via simple HTTP POST requests. The vulnerability was fixed in version 2.4.0.
Affected products
- Data443 GDPR Framework before 2.4.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: patched: Fixed in version 2.4.0