The DSGVO Google Web Fonts GDPR plugin for WordPress allows an attacker to upload arbitrary files because its download function does not check file types. The function is exposed through an unauthenticated AJAX hook, so anyone with internet access can supply a URL to a malicious file such as a PHP webshell. Once the file is written to a publicly accessible directory, the attacker can execute code on the host, leading to full system compromise.

This vulnerability exists in all released versions of the DSGVO Google Web Fonts GDPR plugin from mlfactory up to and including version 1.1. It is actionable only when the site is using one of a small set of themes – twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely – because the plugin relies on those themes’ directory structures for file storage.

With a CVSS score of 9.8 the vulnerability is classified as critical. EPSS information is unavailable and the flaw is not in CISA’s KEV catalog, but the lack of authentication and the ability to place executable code make it highly exploitable in the identified environments. The attack vector is inferred to be through the unauthenticated wp_ajax_nopriv_ endpoint; sites that match the required themes represent a high-risk target set.