Description
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GDPR Data Request Form | 1.5 – ≤ 1.7.1 | — |
References
- https://wpscan.com/vulnerability/710ae5af-01bb-43e8-a853-df00a1ceacab/ exploit vdb-entry technical-description