Vulnerability · Published Oct 9, 2026 · Assigned by WPScan
CVE-2026-85348GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
Medium 4.3
In plain English
A medium-severity cross-site request forgery in GDPR Data Request Form from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)<0.1%top 99.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | GDPR Data Request Form | 1.5 – through 1.7.1 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/710ae5af-01bb-43e8-a853-df00a1ceacab/ exploit, vdb-entry, technical-description