CVE-2026-4298
|
| |
|
|
Affected software |
GOOGLE |
|
|
|
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-4298 |
