GDPR Framework By Data443: Unauthenticated PHP Object Injection
Summary
The WordPress plugin GDPR Framework By Data443 up to and including version 2.5.0 contains an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted serialized data to the plugin, which may allow manipulation of server-side processing and possibly remote code execution; the impact is not verified. No fixed version has been confirmed by the vendor, and the CVSS base score is 9.8 (Critical).
Affected
- GDPR Framework By Data443 WordPress plugin, all versions up to and including 2.5.0
- The latest release is affected according to the CVE description
Fixed in
- Unknown. No fixed version or vendor advisory was found.
- Patchstack lists 2.5.1 as the patched version; this was not confirmed by the vendor and should be verified before relying on it.
Workaround
- Deactivate the plugin until a fix is confirmed, after checking whether cookie consent or data-subject request functions are needed.
- Restrict access to the site or place it behind a web application firewall (WAF) with rules for serialized PHP payloads.
Exploitation
- CISA KEV: not listed.
- Public proof of concept: none found; the researcher is withholding exploit details.
- Observed exploitation in the wild: unknown.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Patchstack expects exploitation; this is a prediction, not an observed event.
Our recommendation
- Check whether the plugin is installed on all WordPress instances, including staging sites and sites managed by third parties.
- Deactivate the plugin or restrict access if it is not business-critical, especially on internet-facing sites.
- Update to a version confirmed as fixed (Patchstack indicates 2.5.1) as soon as the vendor releases it.
- Review web server logs for suspicious POST requests to the plugin endpoints and monitor for further activity.
- Also note CVE-2026-14816, a separate missing-authorization flaw fixed in 2.4.0.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-39797 patchstack.com
- WordPress.org plugin page GDPR Framework wordpress.org
- TheHackerWire CVE-2026-39797 www.thehackerwire.com
- Strix CVE-2026-39797 www.strix.ai
- GitHub astruzocyber CVE issue 1187 github.com
- Researcher LevinityCyber levinitycyber.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:11.
Original description (NVD)
Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.