CVE-2021-42359

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

• CWE-284
• CWE-862

• https://www.wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion/Exploit, Third Party Advisory
• https://www.wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion/Exploit, Third Party Advisory

Published

Nov 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42341checkpath in OpenRC before 0.44.7 uses the direct output of …7.5
• CVE-2021-42342An issue was discovered in GoAhead 4.x and 5.x before 5.1.5.…9.8
• CVE-2021-42343An issue was discovered in the Dask distributed package befo…9.8
• CVE-2021-4235Due to unbounded alias chasing, a maliciously crafted YAML f…5.5
• CVE-2021-42357When using Apache Knox SSO prior to 1.6.1, a request could b…6.1
• CVE-2021-42358The Contact Form With Captcha WordPress plugin is vulnerable…8.8
• CVE-2021-4236Web Sockets do not execute any AuthenticateMethod methods wh…9.8
• CVE-2021-42360On sites that also had the Elementor plugin for WordPress in…5.4
• CVE-2021-42361The Contact Form Email WordPress plugin is vulnerable to Sto…4.8
• CVE-2021-42362The WordPress Popular Posts WordPress plugin is vulnerable t…8.8
• CVE-2021-42363The Preview E-Mails for WooCommerce WordPress plugin is vuln…6.1
• CVE-2021-42364The Stetic WordPress plugin is vulnerable to Cross-Site Requ…8.8