← CVE Intelligence

CVE-2026-85348

GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF PUBLISHED

Description (CNA)

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected (CNA)

Vendor / productVersions
Unknown / GDPR Data Request Formaffected 1.5 through 1.7.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.