PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3535 mlfactory CVE debrief

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the DSGVOGWPdownloadGoogleFonts() function in all versions up to, and including, 1.1. The function is exposed via a wp_ajax_nopriv_ hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

Vendor
mlfactory
Product
DSGVO Google Web Fonts GDPR
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

WordPress users with the DSGVO Google Web Fonts GDPR plugin installed, particularly those using themes twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely, should be aware of this critical vulnerability and take immediate action to protect their sites.

Technical summary

The DSGVO Google Web Fonts GDPR plugin for WordPress has a critical vulnerability (CVSS Score: 9.8) due to arbitrary file upload in the DSGVOGWPdownloadGoogleFonts() function. This function, exposed via a wp_ajax_nopriv_ hook without authentication, fetches and downloads files without validating their type. Attackers can exploit this to upload PHP webshells and execute remote code, provided the site uses specific themes.

Defensive priority

High

Recommended defensive actions

  • Immediately update the DSGVO Google Web Fonts GDPR plugin to a version that fixes the arbitrary file upload vulnerability.
  • Restrict access to the wp_ajax_nopriv_ hook to prevent unauthenticated file uploads.
  • Validate file types before downloading and uploading them to a publicly accessible directory.
  • Monitor for suspicious file uploads and implement a Web Application Firewall (WAF) to detect and block malicious traffic.
  • Consider replacing the plugin with a more secure alternative or applying compensating controls until a fix is available.

Evidence notes

The CVE record was published on 2026-04-08T07:16:21.417Z and has not been modified since then. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD information. Defenders should verify the vulnerability status of their WordPress installations and monitor for suspicious file uploads. Additional verification is recommended due to limited source detail.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T07:16:21.417Z and has not been modified since then. The NVD entry is currently Deferred.