CVE-2026-85348

MediumCVSS 4.3/10Last modified Oct 9, 2026

Description

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 9, 2026
Last modified
Oct 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-853494.3The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to,CVE-2026-85355.3Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised theCVE-2026-853505.3The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign beCVE-2026-853527.0Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-853537.5Out-of-bounds read in Windows Print Spooler Components allows an unauthorized attacker to disclose information over a network.CVE-2026-853547.0Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.CVE-2026-853557.0Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate pCVE-2026-853567.8Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally.CVE-2026-853577.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized atCVE-2026-853587.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853597.8Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privilegesCVE-2026-85363.1Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had