The WP DSGVO Tools (GDPR) WordPress plugin versions older than 3.1.40 fails to perform an authorization check when processing an immediate data‑subject access request. This weakness allows an attacker to supply any user’s e‑mail address and trigger the export of that user’s complete personal data, including name, postal address, phone number, e‑mail address, and comment content. The vulnerability is a classic information disclosure compounded by an improper authorization flaw.

Every installation of the WP DSGVO Tools (GDPR) plugin on a WordPress site that has not been updated to version 3.1.40 or later is affected. The flaw exists under the public web interface of the plugin and can be triggered by any visitor to the site.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is under 1%, revealing a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An unauthenticated attacker can exploit the flaw simply by sending an HTTP request to the plugin’s subject‑access‑request endpoint with a target e‑mail address, causing the server to generate and provide a full personal data export.