CVE-2026-11869 WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request
Unauthenticated attackers can download full personal data exports of any user by supplying their email address due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11869?
CVE-2026-11869 is a medium-severity missing authorization vulnerability in Unknown WP DSGVO Tools (GDPR), published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.
Which versions are affected by CVE-2026-11869?
How do I fix CVE-2026-11869?
No fix has been published for CVE-2026-11869 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-11869 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11869 exists.
Sources
Also known as GHSA-m267-7fgq-g6v7.