Arbitrary File Upload Vulnerability in DSGVO Google Web Fonts Plugin for WordPress

CVE-2026-3535

What is CVE-2026-3535?

The DSGVO Google Web Fonts GDPR plugin for WordPress is susceptible to arbitrary file upload due to inadequate file type validation in its functionality. The DSGVOGWPdownloadGoogleFonts() function, which is publicly accessible without authentication, retrieves CSS files based on user-supplied URLs. This presents a significant security risk, as attackers can exploit this vulnerability to upload arbitrary files, including PHP webshells, to the server. The exploitation requires specific themes to be in use, potentially allowing unauthorized file execution on affected sites.

References