TI-2026-67990 Aliases CVE-2026-39797 GHSA-p7w2-9cvg-5p4v

PHP object injection in WordPress GDPR Framework By Data443 plugin

MEDIUM 49CWE-502Published 2026-10-06 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

The GDPR Framework By Data443 plugin for WordPress through 2.5.0 has a PHP object injection flaw caused by deserialization of untrusted data (CWE-502). Input can be turned into PHP objects without any check. An unauthenticated remote attacker can exploit it without logging in.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00322 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Data443 Risk Mitigation, Inc.	GDPR Framework By Data443	up to 2.5.0	—	No fix listed	CNA

GDPR Framework By Data443 VendorData443 Risk Mitigation, Inc. Affected up to 2.5.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for GDPR Framework By Data443.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-06 Threatist record created from CVE-2026-39797
2026-10-06 Alias added: GHSA-p7w2-9cvg-5p4v
2026-10-06 CISA SSVC decision points changed

References

Other 1

https://patchstack.com/database/wordpress/plugin/gdpr-framework/vulnerability/wordpress-gdpr-framework-by-data443-plugin-2-5-0-php-object-injection-vulnerability?_s_id=cve

TI-2024-35136 WordPress LGPD Framework plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
TI-2026-22512 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability CVSS 3.1HIGH 7.1
TI-2025-30101 WordPress Inline Related Posts plugin <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 6.5
TI-2025-23228 WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability CVSS 3.1MEDIUM 5.9
TI-2025-23227 WordPress Welcome Bar plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
TI-2025-16616 WordPress Posts Footer Manager Plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences