CVE-2021-42359

HIGHNuclei

WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-42359 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 2, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 14, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

WP DSGVO Tools (GDPR)

Browse legalweb / WP DSGVO Tools (GDPR)
CVE List3.1.23 to ≤ 3.1.23affected

wp_dsgvo_tools

Browse legalweb / wp_dsgvo_tools
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHWP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post DeletionCVSS 7.5

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

Impact

Unauthenticated attackers can permanently delete arbitrary WordPress posts and pages by exploiting the unprotected admin-dismiss-unsubscribe AJAX action.

Remediation

Upgrade to WP DSGVO Tools version 3.1.24 or later.

WeaknessesCWE-862CWE-284
Authorsdaffainfo
Template tagscvecve2021wpwordpresswp-plugindsgvointrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CPE: cpe:2.3:a:legalweb:wp_dsgvo_tools:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/shapepress-dsgvo/"
https://www.wordfence.com/blog/2021/11/vulnerability-in-wp-dsgvo-tools-gdpr-plugin-allows-unauthenticated-page-deletion/ https://nvd.nist.gov/vuln/detail/CVE-2021-42359

Source: ProjectDiscovery

References

2