CVE-2026-4298

The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.

• CWE-862

• https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/4.9/dsgvo_all_in_one_wp.php#L1123
• https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/tags/4.9/dsgvo_all_in_one_wp.php#L56
• https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/trunk/dsgvo_all_in_one_wp.php#L1123
• https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/trunk/dsgvo_all_in_one_wp.php#L56
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3503821%40dsgvo-all-in-one-for-wp&new=3503821%40dsgvo-all-in-one-for-wp
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8a5268-03a2-48c6-9c59-840a11e7a34f?source=cve

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42974Integer overflow or wraparound in Windows Performance Monito…8.1
• CVE-2026-42975Heap-based buffer overflow in Windows Bluetooth Port Driver …8.8
• CVE-2026-42976Missing authentication for critical function in Windows RPC …7.8
• CVE-2026-42977Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-42978Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-42979Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-42980Integer underflow (wrap or wraparound) in Windows NT OS Kern…7.8
• CVE-2026-42981Integer underflow (wrap or wraparound) in Windows Performanc…8.1
• CVE-2026-42982Improper validation of consistency within input in Windows S…7.8
• CVE-2026-42983Use after free in Windows DWM Core Library allows an authori…7.8
• CVE-2026-42984Use after free in Windows Kernel allows an authorized attack…7
• CVE-2026-42985Use after free in Remote Desktop Client allows an unauthoriz…8.8