[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvIYnWKeFmUJ4tinBoraR6hjv0_rA2Z432zvuI-HoP44":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-4298","dsgvo-all-in-one-for-wp-missing-authorization-to-authenticated-subscriber-settings-reset","DSGVO All in one for WP \u003C= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset","The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.","dsgvo-all-in-one-for-wp",null,"\u003C=4.9","5.0","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-08 20:46:28","2026-07-09 09:31:21",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F6d8a5268-03a2-48c6-9c59-840a11e7a34f?source=api-prod",1,[22,23,24,25,26,27,28,29],"core\u002Finc\u002Fbackend_settings.php","core\u002Finc\u002Fchangelog.php","dsgvo_all_in_one_wp.php","languages\u002Fdsgvo-all-in-one-for-wp-de_AT.po","languages\u002Fdsgvo-all-in-one-for-wp-de_CH.po","languages\u002Fdsgvo-all-in-one-for-wp-de_DE.po","languages\u002Fdsgvo-all-in-one-for-wp-de_DE_formal.po","languages\u002Fdsgvo-all-in-one-for-wp-it_IT.po","researched",false,3,"# Exploitation Research Plan - CVE-2026-4298\n\n## 1. Vulnerability Summary\nThe **DSGVO All in one for WP** plugin (versions \u003C= 4.9) contains a missing authorization vulnerability in its AJAX handling logic. Specifically, the function `dsgvo_reset_policy_service_func()` (hooked to the `wp_ajax_reset_policy_service` action) fails to implement any capability checks (e.g., `current_user_can( 'manage_options' )`) or nonce verification. This allows any authenticated user, including those with **Subscriber** privileges, to trigger a reset of the plugin's privacy policy settings and content for various services (Google Analytics, Facebook, etc.) to their default values, potentially causing data loss or compliance misconfigurations.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action**: `reset_policy_service`\n- **Method**: POST\n- **Authentication**: Required (Subscriber level or higher)\n- **Vulnerable Parameter**: `service` (inferred, used to specify which policy to reset)\n- **Preconditions**: An attacker must have a valid login to the WordPress site.\n\n## 3. Code Flow\n1. **Hook Registration**: In `dsgvo_all_in_one_wp.php`, the action is registered:\n   ```php\n   add_action( 'wp_ajax_reset_policy_service', __CLASS__ .'::dsgvo_reset_policy_service_func' );\n   ```\n2. **AJAX Request**: A Subscriber sends a POST request to `admin-ajax.php` with `action=reset_policy_service`.\n3. **Execution**: WordPress core invokes `dsdvo_wp_backend::dsgvo_reset_policy_service_func()`.\n4. **Processing**: The function (located in `core\u002Finc\u002Fbackend_settings.php` or `dsgvo_all_in_one_wp.php`) reads the service type from `$_POST`.\n5. **Sink**: The function calls `update_option()` to overwrite existing customized settings with default values defined in `core\u002Finc\u002Ftexts.php` (e.g., `$facebook_policy_sample`).\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required.**\nThe vulnerability report explicitly states that the function lacks nonce verification. The logic likely proceeds directly to processing parameters without calling `check_ajax_referer()` or `wp_verify_nonce()`.\n\n## 5. Exploitation Strategy\n### Step 1: Authentication\nAuthenticate as a Subscriber-level user to obtain valid session cookies.\n\n### Step 2: Target Identification\nDetermine the target option to reset. Common options used by the plugin:\n- `dsdvo_facebook_policy`\n- `dsdvo_google_analytics_policy` (inferred)\n- `dsdvo_cookie_text`\n- `dsdvo_youtube_policy` (inferred)\n\n### Step 3: Trigger Reset\nSend the malicious AJAX request.\n\n**Request Details**:\n- **URL**: `http:\u002F\u002F[target-ip]\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method**: POST\n- **Headers**: `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body**: `action=reset_policy_service&service=facebook` (The value of `service` should be tested among: `facebook`, `google`, `youtube`, `cookie`)\n\n## 6. Test Data Setup\n1. **Plugin Configuration**: Install and activate the plugin (\u003C= 4.9).\n2. **Settings Modification**: As an Administrator, navigate to the plugin settings and enter custom text for the Facebook Policy or Cookie Notice.\n   - Alternatively, use WP-CLI:\n     ```bash\n     wp option update dsdvo_facebook_policy \"MALICIOUS_CUSTOM_CONTENT_FOR_TESTING\"\n     ```\n3. **User Creation**: Create a Subscriber user:\n   ```bash\n   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123\n   ```\n\n## 7. Expected Results\n- The AJAX request should return a `200 OK` or a `1` (success code for WordPress AJAX).\n- The targeted option in the database should revert from \"MALICIOUS_CUSTOM_CONTENT_FOR_TESTING\" to the plugin's default boilerplate text.\n\n## 8. Verification Steps\nAfter the exploit, verify the state of the options via WP-CLI:\n```bash\n# Check if the custom value was overwritten by the default sample text\nwp option get dsdvo_facebook_policy\n```\nIf the output is no longer \"MALICIOUS_CUSTOM_CONTENT_FOR_TESTING\", the exploit is successful.\n\n## 9. Alternative Approaches\nIf the `service` parameter name differs:\n1. Use `grep` on the plugin directory to find the actual implementation of `dsgvo_reset_policy_service_func` to see which `$_POST` keys it accesses:\n   ```bash\n   grep -r \"function dsgvo_reset_policy_service_func\" .\n   ```\n2. If `reset_policy_service` is restricted, try the related hook found in the source:\n   - **Action**: `reset_layertext_service`\n   - **Handler**: `dsgvoaiofree_reset_layertext_service`\n   - This may reset the \"Cookie Layer\" text without authorization.","gemini-3-flash-preview","2026-07-15 22:13:28","2026-07-15 22:14:23",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdsgvo-all-in-one-for-wp\u002Ftags\u002F4.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdsgvo-all-in-one-for-wp.4.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdsgvo-all-in-one-for-wp\u002Ftags\u002F5.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fdsgvo-all-in-one-for-wp.5.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fdsgvo-all-in-one-for-wp\u002Ftags"]