CVE-2026-39797

CriticalCVSS 9.8

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in GDPR Framework By Data443 versions up to 2.5.0. An attacker can inject malicious PHP objects, potentially leading to code execution.

Risk Assessment

Potential for remote code execution, server takeover, or data theft.

Recommendation

Update GDPR Framework By Data443 to a version that includes a fix for this vulnerability.

Other vulnerabilities in GDPR Framework By Data443

CVE-2026-14816Medium
The GDPR Framework By Data443 WordPress plugin before version 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests. This allows unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

Original NVD description (English source)

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS