CVE-2026-91828 in OMGF Plugin
Summary
by MITRE • 10/02/2026
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in versions of the OMGF | GDPR/DSGVO Compliant WordPress plugin prior to 6.3.11 represents a critical server-side resource exhaustion flaw rooted in insufficient access control mechanisms. This security defect allows unauthenticated actors to trigger specific administrative or internal actions without providing valid authentication credentials or nonces, which are standard protective measures in the WordPress ecosystem designed to prevent Cross-Site Request Forgery and unauthorized state-changing operations. By bypassing these checks, an attacker can interact directly with endpoints that initiate server-side loopback requests. These requests are intended for internal communication within the application but lack proper validation of their origin or legitimacy when accessed externally without authorization.
The technical core of this vulnerability lies in the execution of a slow server-side process triggered by external requests. When an unauthenticated user invokes the affected action, the plugin initiates a loopback request that consumes significant PHP worker resources over an extended period. In typical WordPress hosting environments, particularly those using shared hosting or limited resource allocations, the number of available PHP workers is finite and often constrained to prevent server overload. The vulnerability exploits this limitation by forcing each malicious request to occupy one of these scarce workers for a prolonged duration. This behavior effectively ties up backend processing capacity that should be reserved for legitimate user interactions and administrative tasks.
The operational impact of this flaw is severe, leading directly to a Denial of Service condition against the entire website rather than just isolated functionality. As multiple unauthenticated requests are processed simultaneously or in rapid succession, they exhaust the available PHP worker pool. Once all workers are occupied by these malicious loopback operations, legitimate traffic cannot be processed because there are no free resources to handle new connections. This results in a complete site outage where visitors encounter timeouts or error pages, effectively rendering the website unavailable until the server's resource limits reset or the offending processes are manually terminated. The availability of the web application is compromised without any need for user interaction beyond sending HTTP requests, making this an efficient and low-effort attack vector for disrupting service.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it fails to enforce proper authorization checks on sensitive actions. It also relates closely to CWE-770 Allocation of Resources Without Limits or Throttling, given that the system does not restrict the rate or volume of resource-consuming operations from unauthenticated sources. In terms of offensive security frameworks such as MITRE ATT&CK for Enterprise, this behavior is consistent with T1496 Resource Hijacking, where an attacker uses compromised resources to perform malicious activities, and specifically relates to techniques that cause Denial of Service through application-level exhaustion rather than network-layer flooding.
Mitigation strategies must prioritize immediate patching to version 6.3.11 or later, which addresses the missing authentication checks on the vulnerable action endpoints. Administrators should verify their plugin versions regularly and apply updates promptly upon release from trusted sources. In addition to updating, implementing Web Application Firewall rules can provide a temporary layer of defense by rate-limiting requests that target known internal loopback patterns or suspiciously high volumes of POST requests with specific parameter signatures associated with the vulnerable function. Furthermore, reviewing server-level configurations to increase PHP worker limits may offer some resilience against resource exhaustion attacks, although this is not a substitute for fixing the underlying access control flaw. Ensuring strict nonce validation and authentication requirements on all internal API endpoints remains essential for maintaining the integrity and availability of WordPress-based infrastructure.