Data Exposure in WP DSGVO Tools Plugin for WordPress
CVE-2026-11869
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 July 2026
Badges
What is CVE-2026-11869?
The WP DSGVO Tools (GDPR) plugin for WordPress, prior to version 3.1.40, contains a security flaw that lacks proper authorization checks in its data subject access request processing. This vulnerability enables unauthenticated attackers to generate and download full personal data exports, which may include sensitive information such as names, addresses, phone numbers, and email communications simply by supplying the email address of any user, customer, or commenter. This serious oversight poses significant risks to user privacy and compliance with GDPR regulations.
Affected Version(s)
WP DSGVO Tools (GDPR) 0 < 3.1.40
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.