External risk intelligence

DSGVO Google Web Fonts GDPR Plugin Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-3535

This vulnerability affects a WordPress plugin which, by design, functions as part of a public-facing web application. The vulnerable function is exposed via an unauthenticated AJAX hook, making it directly reachable by any remote user accessing the website.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This is a critical vulnerability affecting a WordPress plugin that allows unauthorized users to upload arbitrary files, potentially leading to remote code execution on public-facing websites. The issue stems from insufficient file type validation within the plugin's function.

Unauthenticated file uploads can compromise the site.
It impacts public-facing WordPress websites.
Confirm relevance and exposure for affected sites.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload arbitrary files to a WordPress site by exploiting a vulnerability in the DSGVO Google Web Fonts GDPR plugin. The attacker begins by identifying a vulnerable site and then uses a specially crafted CSS file to trick the plugin into downloading and saving a malicious file, such as a web shell, to a publicly accessible location. This can ultimately allow the attacker to execute code on the server.

No authentication required to trigger.
Arbitrary file upload vulnerability.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by specific themes, this vulnerability could allow unauthenticated attackers to upload arbitrary files to a publicly accessible directory. This could lead to the execution of malicious code on the affected WordPress site.

Arbitrary file upload to public directory.
Via unauthenticated AJAX hook.
Remote code execution risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

WordPress plugin vulnerabilities typically fall under the responsibility of the application owner or platform team, as they manage the website's content and extensions. The immediate first step is to identify all instances of the affected plugin, confirm if any are exposed to the internet and business-critical, and then assign an accountable owner for remediation planning.

Application owners should address this vulnerability.
Verify plugin presence and exposure on all sites.
Plan remediation with vendor and owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DSGVO Google Web Fonts GDPR plugin?

This is a WordPress plugin designed to help site administrators manage Google Fonts in compliance with GDPR privacy regulations. It typically handles the downloading and hosting of font files locally so that the website does not need to connect to external Google servers, which helps protect user data privacy. Because it manages external resources, the plugin includes functional logic for fetching and storing files on the local web server.

What does CWE-434 mean regarding CVE-2026-3535?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the plugin fails to check the file extension or content type before saving a file to the server. Because the plugin blindly trusts the files it downloads, an attacker can provide a link to a malicious script—such as a PHP file—instead of a legitimate font, tricking the system into storing it where it can be executed.

How can an attacker trigger this vulnerability?

An attacker triggers this by interacting with the plugin's AJAX hook, which is publicly accessible and requires no login. The attacker provides a URL for a crafted CSS file; the plugin fetches that file, reads it to find other file paths, and then downloads those files. The bug is not triggered if your site uses a theme other than the specific list identified (such as twentyfifteen or storefront), as the vulnerable function behavior is tied to these specific theme configurations.

Do I need to worry if my site is not public-facing?

According to Halo Surface Signal, this vulnerability is considered a high-priority risk precisely because it affects a WordPress plugin designed for web-facing applications. Because the vulnerable function is exposed via an unauthenticated network request, any site accessible over the internet is a potential target. If your WordPress site is strictly internal and unreachable from the public internet, the practical reach of this specific network-based attack vector is significantly reduced.

What is the first step to remediate this issue?

The most effective first step is to inventory your WordPress sites to identify any instance where the DSGVO Google Web Fonts GDPR plugin is active. Once identified, verify if the site utilizes one of the themes known to enable the vulnerable function path. Since this is an arbitrary file upload risk, you should prioritize removing or disabling the plugin until a verified update or secure alternative is available to protect the server from unauthorized code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.