The WP DSGVO Tools (GDPR) WordPress plugin before version 3.1.40 lacks an authorization check on the immediate‑processing path of its data subject access request feature. This allows an attacker who can supply a target user’s e‑mail address to trigger the plugin to generate and deliver a full personal‑data export, including name, address, phone, e‑mail and comment content. The result is a breach of confidentiality and violation of privacy regulations, consistent with the weaknesses identified as improper access control and information exposure.

All installations of WP DSGVO Tools (GDPR) WordPress plugin version 3.1.39 and earlier are affected. The vulnerability affects any WordPress site deploying the plugin prior to the 3.1.40 release.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. An unauthenticated attacker can exploit the flaw simply by making a HTTP request to the subject‑access‑request endpoint with a valid email address. No special privileges or network access beyond web access are required, making the attack vector likely through the public web surface.