CVE-2026-39797
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Patchstack

Description
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-39797
EUVD
EUVD-2026-93041

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Data443 Risk Mitigation, Inc. GDPR Framework By Data443 n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated PHP Object Injection vulnerability in the GDPR Framework By Data443 plugin versions 2.5.0 or below. It allows attackers to inject malicious PHP objects into the application without authentication, potentially leading to remote code execution or other harmful server actions.

Detection Guidance

Detecting this PHP Object Injection vulnerability requires checking for the presence of the vulnerable GDPR Framework By Data443 plugin version 2.5.0 or below. Inspect your WordPress installation for the plugin in the /wp-content/plugins/ directory. Look for the plugin folder named 'gdpr-framework-by-data443' or similar. Verify the version in the plugin's main PHP file or via the WordPress admin panel. If found, the system is likely vulnerable.

Impact Analysis

Attackers can exploit this flaw to execute arbitrary code on your server, steal sensitive data, or take control of your website. Since no authentication is required, the risk of exploitation is high, especially for websites using vulnerable versions of the plugin.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA compliance requirements. Exploited sites may face legal penalties, reputational damage, and loss of user trust due to compromised personal or health data.

Mitigation Strategies

Immediately apply Patchstack's mitigation rule to block attacks until an official patch is released. Consider updating the plugin or contacting your hosting provider or developer for assistance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39797. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart