CVE-2021-42359

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.

WP DSGVO Tools (GDPR) versiones anteriores a 3.1.23 incluyéndola, tenía una acción AJAX, "admin-dismiss-unsubscribe", que carecía de una comprobación de capacidad y de una comprobación de nonce y estaba disponible para usuarios no autenticados, y no comprobaba el tipo de entrada cuando eliminaba las peticiones unsubscription. De este modo, un atacante podía eliminar permanentemente una entrada o página arbitraria del sitio enviando una petición AJAX con el parámetro "action" establecido como "admin-dismiss-unsubscribe" y el parámetro "id" establecido como la entrada que se iba a eliminar. El envío de dicha petición movería el post a la papelera, y la repetición de la petición eliminaría permanentemente el post en cuestión