fixnx
mediumCVE-2026-11869

WP DSGVO Tools GDPR Personal Data Export Authorization Bypass Vulnerability

The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.

Browse WordPress security risks
ProductWP DSGVO Tools (GDPR)
CVSS5.3
EPSSNot scored yet
UpdatedJuly 10, 2026

Quick answer

WP DSGVO Tools (GDPR) should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.

Who is affected

Affected versions

  • WP DSGVO Tools (GDPR) before 3.1.40

Fixed versions

  • 3.1.40

How to fix it

WP DSGVO Tools before 3.1.40 allowed unauthenticated personal-data export requests by email address. Update the plugin and review export logs because the issue can expose GDPR/DSGVO personal data.

  1. Inventory WordPress sites running WP DSGVO Tools before 3.1.40.
  2. Update WP DSGVO Tools to version 3.1.40 or later.
  3. Disable personal-data export endpoints until the update is complete if patching is delayed.
  4. Review data export logs, email logs, and download records for requests tied to unexpected email addresses.
  5. Expire generated export links and remove stale export archives from the server.
  6. Notify privacy and legal stakeholders if unauthorized personal-data exports may have occurred.
  7. Require authenticated or verified email flows for future data access requests.

Scan now. Google sign-in is only needed to unlock fix guidance.

Verify the fix

  • Confirm WP DSGVO Tools is running version 3.1.40 or later.
  • Validate unauthenticated users cannot trigger personal-data exports for arbitrary email addresses.
  • Confirm old export links and archives are removed or expired.
  • Review mail and web logs for suspicious export activity.
  • Run a Fixnx scan and confirm exposed GDPR export endpoints are not vulnerable.

Related categories

WordPressAuthorization BypassInformation Disclosure

Related security risks

More published guidance from the same primary category.

medium

Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter

Updated July 24, 2026

high

CVE-2026-65500 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability

Updated July 24, 2026

medium

Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

Updated July 24, 2026

Trusted references

Source advisoryNVD

FAQ

What is affected by CVE-2026-11869?

WP DSGVO Tools (GDPR) versions listed as affected should be reviewed: WP DSGVO Tools (GDPR) before 3.1.40.

What should I fix first?

Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.

How do I confirm the fix worked?

Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.

How are Fixnx security risk categories chosen?

Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.