The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

The WordPress WP GDPR Compliance Plugin installed on the remote host is affected by an arbitrary option udpate vulnerability and an arbitrary action call vulnerability due to a failure to properly sanitize user-supplied input to the 'save_setting' parameter of the 'wp-admin/admin-ajax.php' script. An unauthenticated, remote attacker can leverage this issue to escalate privileges and execute arbitrary code on the affected host.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The WordPress application running on the remote host has a version of the 'WP GDPR Compliance' plugin that is prior to 1.4.3 and, thus, is affected by a user-input validation error that can allow privilege escalation attacks. Such attacks allow, among other actions, creation of new administrator-level users.

ID	Name	Product	Family	Severity
98548	WP GDPR Compliance Plugin for WordPress < 1.4.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
118935	WordPress Plugin 'WP GDPR Compliance' < 1.4.3 Privilege Escalation	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2018-19207

critical

Tenable Plugins

critical

critical