CVE-2026-3535

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_nopriv_` hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-353506.6The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the CVE-2026-353514.2The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls b CVE-2026-353527.0A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then CVE-2026-353533.3The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived perm CVE-2026-353544.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended a CVE-2026-353556.3The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. Th CVE-2026-353566.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command CVE-2026-353574.7The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with u CVE-2026-353585.5The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sou CVE-2026-353594.7A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference inte CVE-2026-35368.8Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acc CVE-2026-353606.3The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the