CVE-2021-42359: falha de alta gravidade em legalweb WP DSGVO Tools (GDPR)
WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion
Publicada em · Atualizada em
58Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 7.5epss 3.8%
da publicação à arma
Publicada no NVD5 de nov.
VulnCheck2 de nov.
probabilidade de exploração
3.8%top 10% das CVEs
exploração observada
simVulnCheck
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
legalweb · WP DSGVO Tools (GDPR)CVEs relacionadas — legalweb WP DSGVO Tools (GDPR)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-4358HIGHWP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2026-4283CRITICALWP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin UsersEPSS 0.7%CVE-2026-10034MEDIUMWP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)EPSS 0.6%CVE-2026-0914MEDIUMWP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' ShortcodeEPSS 0.3%CVE-2024-3201MEDIUMWP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%