Summaryinfo

A vulnerability was found in legalweb WP DSGVO Tools Plugin up to 3.1.38 on WordPress and classified as critical. This issue affects some unknown processing of the component Shortcode Handler. Such manipulation of the argument username/email leads to authorization. This vulnerability is traded as CVE-2026-4283. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in legalweb WP DSGVO Tools Plugin up to 3.1.38 on WordPress. It has been rated as critical. Affected by this issue is an unknown code of the component Shortcode Handler. The manipulation of the argument username/email with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity, and availability. CVE summarizes:

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action accepting a `process_now` parameter from unauthenticated users, which bypasses the intended email-confirmation flow and immediately triggers irreversible account anonymization. This makes it possible for unauthenticated attackers to permanently destroy any non-administrator user account (password randomized, username/email overwritten, roles stripped, comments anonymized, sensitive usermeta wiped) by submitting the victim's email address with `process_now=1`. The nonce required for the request is publicly available on any page containing the `[unsubscribe_form]` shortcode.

The weakness was shared by Angus Girvan. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-4283 since 03/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 3.1.38 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• legalweb

Name

• WP DSGVO Tools Plugin

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10
• 3.1.11
• 3.1.12
• 3.1.13
• 3.1.14
• 3.1.15
• 3.1.16
• 3.1.17
• 3.1.18
• 3.1.19
• 3.1.20
• 3.1.21
• 3.1.22
• 3.1.23
• 3.1.24
• 3.1.25
• 3.1.26
• 3.1.27
• 3.1.28
• 3.1.29
• 3.1.30
• 3.1.31
• 3.1.32
• 3.1.33
• 3.1.34
• 3.1.35
• 3.1.36
• 3.1.37
• 3.1.38

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion