CVE-2026-4298

MediumCVSS 4.3/10Last modified Jul 9, 2026

Description

The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2026
Last modified
Jul 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-429807.8Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-429818.1Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.CVE-2026-429827.8Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-429837.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-429847.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-429858.8Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-429867.8Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2026-429878.1Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.CVE-2026-429897.8Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-42995.3The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due CVE-2026-429909.8Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.CVE-2026-429917.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authoriz
CVE-2026-4298: Medium severity, CVSS 4.3 | Vulnix