The WP DSGVO Tools (GDPR) plugin versions prior to 3.1.40 do not perform proper authorization checks on the immediate-processing path of the data subject access request feature. This allows unauthenticated attackers to request and retrieve full personal data exports for any user, customer, or commenter by providing their email address. The exposed personal data includes sensitive information such as names, postal addresses, phone numbers, emails, and comment content. This vulnerability is tracked as CVE-2026-11869 and has a CVSS v3.1 base score of 5.3, indicating a medium severity level. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can access and download sensitive personal data of any user, customer, or commenter of the affected WordPress site. This data exposure includes personally identifiable information such as names, postal addresses, phone numbers, email addresses, and comment content. The confidentiality of user data is compromised, potentially violating privacy regulations and exposing the site owner to legal and reputational risks. There is no indication of impact to data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider disabling or restricting access to the data subject access request feature to prevent unauthorized data exports. Monitoring for updates from the plugin vendor or WPScan is recommended to apply patches promptly once released.