The GDPR Data Request Form WordPress plugin, up to version 1.7.1, does not enforce CSRF protection when an administrator updates one of its settings. An attacker who can induce a site administrator to click a crafted link or submit a forged request may change the setting, for example by setting the DPO email address to an attacker‑controlled address. This allows the attacker to redirect or harvest personally identifiable information, facilitating further phishing or unauthorized data exposure. The vulnerability does not provide code execution or denial of service, but it permits an authenticated administrator to alter critical configuration data, potentially compromising user privacy and downstream compliance efforts.

The issue affects any WordPress site that installs GDPR Data Request Form version 1.7.1 or earlier. Any site that has not upgraded beyond this version is vulnerable, regardless of other security controls, because the flaw resides solely in the plugin’s settings update mechanism.

The CVSS score of 4.3 places this vulnerability in the low‑to‑medium severity band. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is user interaction: a social‑engineering campaign can entice an administrator to visit a malicious link that submits the forged request. While exploitation requires an authenticated admin role, the lack of mitigation on the settings endpoint means the attacker can succeed once the admin interacts with the crafted request.