CVE-2026-3535

OVERVIEW The DSGVO Google Web Fonts GDPR plugin for WordPress versions 1.1 and earlier contains an arbitrary file upload vulnerability in the DSGVOGWPdownloadGoogleFonts() function. The vulnerability exists because the plugin fails to validate file types when downloading files from user-supplied URLs. The vulnerable function is exposed via an unauthenticated AJAX hook, allowing any visitor to trigger the upload mechanism. Exploitation requires the target site to use one of six specific WordPress themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. SEVERITY This vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL with a network-based attack vector requiring no authentication, no special configuration, and no user interaction. An unauthenticated attacker can exploit this remotely to upload arbitrary files, including PHP webshells, to publicly accessible directories on the affected server. The vulnerability enables remote code execution with full system compromise potential, affecting confidentiality, integrity, and availability. The FAUCET Risk Score of 55.0/100 indicates moderate additional risk factors beyond the base CVSS assessment. EXPLOITATION STATUS This vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.0034 indicates this threat ranks below average for real-world exploitation probability. There is no indication of publicly available exploit code, and community attention appears limited, suggesting organizations should prioritize patching based on plugin installation prevalence rather than immediate threat response.