Description
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
WordPress WP GDPR Compliance Plugin Privilege Escalation
auxiliary/admin/http/wp_gdpr_compliance_privesc
GitHub 3 repositories
-
aeroot/WP-GDPR-Compliance-Plugin-Exploit ★ 4 · Nov 27, 2018
Exploit of the privilege escalation vulnerability of the WordPress plugin "WP GDPR Compliance" by "Van Ons" (https://de.wordpress.org/plugins/wp-gdpr-compliance/) CVE-2018-19207
-
AnotherSec/CVE-2018-19207 ★ 1 · Sep 1, 2025
WP GDPR Compliance <= 1.4.2 - Remote Code Execution (exploiter)
-
cved-sources/cve-2018-19207 ★ 0 · Mar 15, 2019
cve-2018-19207
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option http/cves/2018/CVE-2018-19207.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.