What the vulnerability does
01Description
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.
Explanation of Vulnerability in Simple Terms
02Summary
The DSGVO All in one for WP plugin versions 4.9 and earlier lack proper authorization checks on certain functions. A logged-in user with low privileges can modify data they should not have access to. The plugin does not validate user permissions before allowing changes to sensitive settings.
What an attacker can do
03Attacker Capabilities
A low-privilege logged-in user can modify plugin settings or data they should not have access to.
Potential impact on your site
04Site Impact
Unauthorized users can alter GDPR compliance settings or other plugin configuration, potentially exposing your site to compliance violations.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level permissions (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
July 9, 2026
CVE published
July 9, 2026
Record updated
