Unauthenticated Data Export in WP DSGVO Tools Plugin

Executive Summary

The WP DSGVO Tools (GDPR) WordPress plugin, before version 3.1.40, has a critical vulnerability that allows unauthenticated attackers to access sensitive personal information without any authorization check.

This flaw exists in the Subject Access Request (SAR) feature of the plugin, where attackers can generate and download a full personal-data export of any user, customer, or commenter by simply providing their email address.

The exported data includes names, postal addresses, phone numbers, emails, and comment content. The attack requires no authentication or cookies and involves extracting a hidden nonce from the SAR form and sending a crafted request to retrieve a download link for the victim's data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive personal information of users, customers, or commenters on a WordPress site using the affected plugin.

An attacker can obtain full personal data exports including names, postal addresses, phone numbers, emails, and comment content without any authentication.

Such a data breach can result in privacy violations, identity theft, reputational damage, and potential legal consequences for the site owner.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability directly undermines compliance with data protection regulations such as GDPR by allowing unauthorized access to personal data.

Since GDPR mandates strict controls over personal data access and processing, the missing authorization check in the plugin's Subject Access Request feature violates these requirements.

Failure to protect personal data adequately can lead to regulatory penalties, legal liabilities, and loss of user trust.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized requests to the Subject Access Request (SAR) feature of the WP DSGVO Tools plugin. Specifically, look for HTTP requests that access the SAR form and include attempts to extract the hidden nonce and send crafted requests to generate personal-data exports.

Detection commands or methods may include inspecting web server logs for unusual POST or GET requests to the plugin's SAR endpoint, especially those containing email addresses as parameters without proper authentication.

For example, using command-line tools like curl or wget to simulate or detect such requests could help identify exploitation attempts.

• Use web server log analysis tools or grep to find requests to the SAR form URL with email parameters.
• Example command to search logs: grep -i 'subject_access_request' /var/log/apache2/access.log | grep -E 'email='
• Monitor for requests that extract the hidden nonce and then send follow-up requests to download personal data.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation step is to update the WP DSGVO Tools (GDPR) WordPress plugin to version 3.1.40 or later, where the authorization check issue has been fixed.

Until the update can be applied, restrict access to the SAR feature by limiting access to trusted users or IP addresses, or temporarily disabling the feature if possible.

Additionally, monitor your logs for suspicious activity related to the SAR feature to detect potential exploitation attempts.

Useful 0 Not Useful 0