Vulnerability · Published Jul 9, 2026 · Assigned by WPScan
CVE-2026-11869WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request
Medium 5.3
In plain English
A medium-severity security flaw in WP DSGVO Tools (GDPR) from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 74.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP DSGVO Tools (GDPR) | 0 – before 3.1.40 |
References
- https://wpscan.com/vulnerability/49170650-0006-4f3b-90f4-f8bb176beb7b/ exploit, vdb-entry, technical-description