CVE-2024-11069

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
welaunch	WordPress GDPR	<= 2.0.2
welaunch	wordpress_gdpr\&ccpa	<= 2.0.2

References

Timeline

Published: Nov 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-11079.8Authorization Bypass Through User-Controlled Key vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Acc CVE-2024-110705.4A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown proces CVE-2024-110718.8Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) whi CVE-2024-110738.1A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of t CVE-2024-110749.8A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of CVE-2024-110758.8A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privil CVE-2024-110769.8A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown proc CVE-2024-110779.8A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the fi CVE-2024-110785.4A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Affected by this vulnerability is an unkn CVE-2024-110795.5A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to refe CVE-2024-11088.2The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_ini CVE-2024-110809.8The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to