WordPress GDPR Data Request Form plugin 1.5-1.7.1 - DPO Email Update vulnerability

DPO Email Update vulnerability discovered by Shikhali Jamalzade in WordPress Plugin GDPR Data Request Form versions 1.5-1.7.1...

CVE-2026-85348

The GDPR Data Request Form WordPress plugin (versions 1.5 through 1.7.1 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists because the plugin lacks CSRF protection when updating specific settings, such as the DPO Email . An attacker can execute a forged request to modify the...