CVE-2026-4298: CWE-862 Missing Authorization in mlfactory DSGVO All in one for WP
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.
AI Analysis
Technical Summary
CVE-2026-4298 is a missing authorization vulnerability (CWE-862) in the DSGVO All in one for WP plugin for WordPress. The issue is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while handling user-supplied parameters to reset plugin options. This flaw enables authenticated attackers with low privileges (Subscriber-level and above) to reset all customized privacy policy content, such as cookie notices and policies related to Google Analytics, Facebook, and YouTube, to default values. The vulnerability affects all versions up to and including 4.9. No official patch or remediation has been documented yet.
Potential Impact
An attacker with Subscriber-level access or higher can reset all customized privacy policy content in the plugin to default values. This impacts the integrity of privacy-related configurations but does not affect confidentiality or availability. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and low privileges required, with no user interaction needed and no confidentiality or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only to reduce risk. Monitor for updates from the vendor or plugin author regarding patches or official mitigations.
CVE-2026-4298: CWE-862 Missing Authorization in mlfactory DSGVO All in one for WP
Description
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4298 is a missing authorization vulnerability (CWE-862) in the DSGVO All in one for WP plugin for WordPress. The issue is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while handling user-supplied parameters to reset plugin options. This flaw enables authenticated attackers with low privileges (Subscriber-level and above) to reset all customized privacy policy content, such as cookie notices and policies related to Google Analytics, Facebook, and YouTube, to default values. The vulnerability affects all versions up to and including 4.9. No official patch or remediation has been documented yet.
Potential Impact
An attacker with Subscriber-level access or higher can reset all customized privacy policy content in the plugin to default values. This impacts the integrity of privacy-related configurations but does not affect confidentiality or availability. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low complexity and low privileges required, with no user interaction needed and no confidentiality or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only to reduce risk. Monitor for updates from the vendor or plugin author regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-16T19:14:02.711Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4f797f68715ace432894ec
Added to database: 07/09/2026, 10:35:43 UTC
Last enriched: 07/09/2026, 10:49:03 UTC
Last updated: 07/09/2026, 16:13:50 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.