Cyber Posture

CVE-2026-3535

Critical

Published: 08 April 2026

Published
08 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0034 56.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_nopriv_`…

more

hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the missing file type validation in the DSGVOGWPdownloadGoogleFonts() function by requiring validation of user-supplied URLs and extracted file content to prevent arbitrary file uploads.

SI-3 Malicious Code Protection good match
preventdetect

Deploys malicious code protection at web server entry points to scan and eradicate PHP webshells uploaded to publicly accessible directories, mitigating remote code execution.

CM-7 Least Functionality good match
prevent

Restricts WordPress to least functionality by disabling unnecessary plugins like DSGVO Google Web Fonts GDPR or their unauthenticated AJAX hooks, eliminating the vulnerable endpoint.

Security SummaryAI

CVE-2026-3535 is an arbitrary file upload vulnerability in the DSGVO Google Web Fonts GDPR plugin for WordPress, affecting all versions up to and including 1.1. The issue stems from missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function, which is exposed via a `wp_ajax_nopriv_` hook that requires no authentication. This function fetches a user-supplied URL treated as a CSS file, extracts embedded URLs from its content, and downloads those files directly to a publicly accessible directory.

Unauthenticated attackers can exploit this vulnerability by providing a malicious CSS file URL containing references to arbitrary files, such as PHP webshells. The downloaded files bypass validation and land in a web-accessible location, enabling remote code execution. Exploitation requires the target WordPress site to use one of the following specific themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Advisories reference the vulnerable code locations in the plugin's source, including line 159 and line 46 in both the 1.1 tag and trunk versions of `dsgvo-google-web-fonts-gdpr.php`. Additional details are available in Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/6203ffaf-5efd-4c66-85f0-cc3a05a03084?source=cve.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

The vulnerability allows unauthenticated arbitrary file upload to a web-accessible directory, enabling exploitation of public-facing applications (T1190) and deployment of web shells for remote code execution (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References