DSGVO All in One for WP WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Account Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the DSGVO All in One for WP WordPress plugin, affecting all versions through 4.6. The issue arises from inadequate nonce validation in the user_remove_form.php file, enabling unauthenticated attackers to delete admin user accounts by tricking an administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of admin user accounts.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to a WordPress site using the DSGVO All in One for WP plugin version 4.6 or earlier. The request must include a valid nonce for the 'once_remove_user' action. This can be achieved by convincing an administrator to click a link that triggers the request, such as through a phishing email or message.

Remediation

Users are advised to update the DSGVO All in One for WP WordPress plugin to version 4.7 or later.