CVE-2026-3535
Unauthenticated Arbitrary File Upload in DSGVO Google Web Fonts Plugin
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The DSGVO Google Web Fonts GDPR plugin for WordPress has a vulnerability that allows attackers to upload arbitrary files without proper validation. This happens because the function DSGVOGWPdownloadGoogleFonts() accepts a user-supplied URL, fetches it as a CSS file, extracts URLs from it, and downloads those files to a public directory without checking the file types.
Since this function is accessible via a wp_ajax_nopriv_ hook, no authentication is required to exploit it. Attackers can upload malicious files, including PHP webshells, which can then be executed remotely.
However, the exploit only works if the WordPress site uses one of certain themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows unauthenticated attackers to upload and execute arbitrary code on the affected WordPress site.
- Remote code execution leading to full site compromise.
- Potential data theft or manipulation.
- Defacement or disruption of website services.
- Use of the compromised site as a launchpad for further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP webshells, leading to remote code execution on affected WordPress sites. This can result in unauthorized access to sensitive data and system compromise.
Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and breaches.