CVE-2026-4298
MediumCVSS 4.3Summary
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. The dsgvo_reset_policy_service_func() function lacks both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This allows authenticated attackers with Subscriber-level access and above to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.
Risk Assessment
The organization may lose customized privacy policy settings, potentially leading to GDPR non-compliance and possible fines. An attacker can easily revert default content, disrupting data protection compliance.
Recommendation
Immediately update the DSGVO All in one for WP plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin until a patch is released.
Other vulnerabilities in DSGVO All in one for WP
Original NVD description (English source)
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS