Threat Entry Updated 2026-07-09

CVE-2026-4298 - One For Wp Plugin

The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.

PLUGIN One For Wp

CVE-2026-4298

MEDIUM CVSS 4.3 2026-07-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-05-23

CVE-2024-13356 - One For Wp Plugin

The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the user_remove_form.php file. This makes it possible for unauthenticated attackers to delete admin user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN One For Wp

CVE-2024-13356

MEDIUM CVSS 6.5 2025-02-04

Risk Score

Open Full Technical Breakdown