WP DSGVO Tools (GDPR) WordPress Plugin Unauthenticated Personal Data Export Vulnerability

A vulnerability exists in the WP DSGVO Tools (GDPR) WordPress plugin in versions prior to 3.1.40. The plugin's data subject access request feature lacks proper authorization checks, enabling unauthenticated attackers to generate and download personal data exports of any user, customer, or commenter by simply providing their email address. The exported data includes the individual's name, postal address, phone number, email, and comment content.

Impact

Exploitation of this vulnerability allows for unauthorized access to and download of personal data, including names, addresses, phone numbers, emails, and comment content, of any WordPress user, customer, or commenter.

Reproduction

To reproduce this vulnerability, first ensure that a published Subject Access Request (SAR) form page exists. This can be done by using the plugin's setup feature or manually creating and publishing a page with the appropriate shortcode. Next, as an unauthenticated user, access the SAR form page and copy the hidden nonce value. Then, send a request to the WordPress site's admin-ajax.php file, using the 'subject-access-request' action. Include the copied nonce, the email address of the target user, and other required form data. The response will contain a token that can be used to download the personal data export. Finally, use the token to request the data export, which will be delivered as a PDF containing the victim's personal information.

Remediation

Users are advised to update the WP DSGVO Tools (GDPR) WordPress plugin to version 3.1.40 or later.