CVE-2026-85348
GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
| Vendor | unknown |
| Product | gdpr data request form |
| Published | Oct 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gdpr data request form
Be the first to know when new medium vulnerabilities affecting unknown gdpr data request form are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / GDPR Data Request Form
1.5 ≤ 1.7.1
References
Credits
Shikhali Jamalzade WPScan