CVE-2026-11869

The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2026-07-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/49170650-0006-4f3b-90f4-f8bb176beb7b/

References

• CVE Record
• NVD entry

Related

• CVE-2026-11868
• CVE-2026-11870
• CVE-2026-11867
• CVE-2026-11872
• CVE-2026-11866
• CVE-2026-11875