CVE-2026-3535 is a critical vulnerability in the mlfactory DSGVO Google Web Fonts GDPR WordPress plugin. The vulnerability arises from the `DSGVOGWPdownloadGoogleFonts()` function, which is accessible without authentication through a `wp_ajax_nopriv_` hook. This function downloads files from user-supplied URLs without validating file types, enabling attackers to upload arbitrary files, including executable PHP scripts, to a publicly accessible directory. Successful exploitation can result in remote code execution on affected sites that use specific themes such as twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. The CVSS 3.1 base score is 9.8, reflecting the high impact and ease of exploitation.

An unauthenticated attacker can upload arbitrary files, including PHP webshells, to the server hosting the vulnerable plugin. This can lead to full remote code execution, compromising confidentiality, integrity, and availability of the affected WordPress site. The vulnerability affects sites using certain themes, increasing the attack surface for those configurations. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, disabling or removing the DSGVO Google Web Fonts GDPR plugin until a fix is released is recommended. Additionally, restricting access to the affected AJAX endpoint or limiting the use of the vulnerable themes may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.