Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

WP DSGVO Tools Plugin Exposes WordPress Accounts to Unwanted Deletion

CVE-2026-4283 · published 7 months ago
Summary

An attacker can delete any non-admin WordPress user account without permission by exploiting a vulnerability in the WP DSGVO Tools plugin. This can happen if the plugin is installed and an attacker knows the victim's email address. To fix this, update the plugin to version 3.1.39 or later.

Original advisory text
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action acc...
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action accepting a `process_now` parameter from unauthenticated users, which bypasses the intended email-confirmation flow and immediately triggers irreversible account anonymization. This makes it possible for unauthenticated attackers to permanently destroy any non-administrator user account (password randomized, username/email overwritten, roles stripped, comments anonymized, sensitive usermeta wiped) by submitting the victim's email address with `process_now=1`. The nonce required for the request is publicly available on any page containing the `[unsubscribe_form]` shortcode.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published24 Mar 2026
Updated4 Nov 2026
First seen24 Mar 2026
Sources
CVE-2026-4283 · NVD
Track software like this
Free during beta