A flaw in WP DSGVO Tools (GDPR) allows an unauthenticated attacker to trigger the subject‑access‑request process via AJAX parameters, causing the plugin to return tokenized links that expose the victim’s personal data such as WordPress account information, comment author details, email addresses, IP addresses, and comment content. The vulnerability stems from an authorization bypass (CWE‑862) where the plugin fails to verify user permissions before executing the request.

Legalweb’s WP DSGVO Tools (GDPR) plugin, versions up to and including 3.1.39, is impacted. All installations of these versions running on WordPress sites are susceptible unless otherwise patched. No other products or later versions were listed as affected in the provided data.

The CVSS score of 5.3 indicates a medium severity level. The EPSS score is not provided, which limits a precise assessment of exploitation likelihood, but the absence of a KEV listing suggests that no widespread exploitation campaigns are known. The attack vector is inferred to be the AJAX endpoint (process_now and is_ajax parameters) which can be reached via standard HTTP requests; no privileged access is required from the attacker. Once triggered, the system returns downloadable links that contain the sensitive data, thereby compromising confidentiality.