The DSGVO All in one for WP plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper nonce validation in user_remove_form.php. This flaw enables unauthenticated attackers to delete administrator accounts by tricking a logged-in site administrator into executing a crafted request, such as clicking a malicious link. The vulnerability affects all versions up to 4.6 and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), reflecting a medium severity impact primarily on integrity. No patch or official remediation guidance is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an attacker to delete administrator user accounts on the affected WordPress site without authentication by leveraging CSRF. This compromises the integrity of the site’s administrative user base but does not directly impact confidentiality or availability. There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should exercise caution when interacting with untrusted links or content. Consider disabling or removing the vulnerable plugin if possible to prevent exploitation.