CVE-2026-85348

GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected

GDPR Data Request Form

CVSS v3.1 WPSCAN

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.10% chance of exploitation in the next 30 days, 1st percentile

Published

2026-10-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/710ae5af-01bb-43e8-a853-df00a1ceacab/

References

• CVE Record
• NVD entry