PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3535 mlfactory CVE debrief

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the DSGVOGWPdownloadGoogleFonts() function in all versions up to, and including, 1.1. The function is exposed via a wp_ajax_nopriv_ hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

Vendor
mlfactory
Product
DSGVO Google Web Fonts GDPR
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

WordPress users with the DSGVO Google Web Fonts GDPR plugin installed, particularly those using themes twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely, should be aware of this critical vulnerability and take immediate action to protect their sites.

Technical summary

The DSGVO Google Web Fonts GDPR plugin for WordPress has a critical vulnerability (CVSS Score: 9.8) due to arbitrary file upload in the DSGVOGWPdownloadGoogleFonts() function. This function, exposed via a wp_ajax_nopriv_ hook without authentication, fetches and downloads files without validating their type. Attackers can exploit this to upload PHP webshells and execute remote code, provided the site uses specific themes.

Defensive priority

High

Recommended defensive actions

  • Immediately update the DSGVO Google Web Fonts GDPR plugin to a version that fixes the arbitrary file upload vulnerability.
  • Restrict access to the wp_ajax_nopriv_ hook to prevent unauthenticated file uploads.
  • Validate file types before downloading and uploading them to a publicly accessible directory.
  • Monitor for suspicious file uploads and implement a Web Application Firewall (WAF) to detect and block malicious traffic.
  • Consider replacing the plugin with a more secure alternative or applying compensating controls until a fix is available.

Evidence notes

The CVE record was published on 2026-04-08T07:16:21.417Z and has not been modified since then. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD information. Defenders should verify the vulnerability status of their WordPress installations and monitor for suspicious file uploads. Additional verification is recommended due to limited source detail.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3535 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3535

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3535 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3535

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/tags/1.1/dsgvo-google-web-fonts-gdpr.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/tags/1.1/dsgvo-google-web-fonts-gdpr.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/trunk/dsgvo-google-web-fonts-gdpr.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/trunk/dsgvo-google-web-fonts-gdpr.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.