2 lines
3.7 KiB
JSON
2 lines
3.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DSGVO Google Web Fonts GDPR","vendor":"mlfactory","versions":[{"lessThanOrEqual":"1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_nopriv_` hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely)."},{"lang":"es","value":"El plugin DSGVO Google Web Fonts GDPR para WordPress es vulnerable a la carga arbitraria de archivos debido a la falta de validación del tipo de archivo en la función 'DSGVOGWPdownloadGoogleFonts()' en todas las versiones hasta la 1.1, inclusive. La función está expuesta a través de un hook 'wp_ajax_nopriv_', que no requiere autenticación. Recupera una URL proporcionada por el usuario como un archivo CSS, extrae URLs de su contenido y descarga esos archivos a un directorio de acceso público sin validar el tipo de archivo. Esto permite a atacantes no autenticados cargar archivos arbitrarios, incluyendo webshells PHP, lo que lleva a la ejecución remota de código. El exploit requiere que el sitio utilice uno de un puñado de temas específicos (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient o shapely)."}],"id":"CVE-2026-3535","lastModified":"2026-07-24T21:10:00.143","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3535","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-08T18:03:46.198479Z","version":"2.0.3"}}]},"published":"2026-04-08T07:16:21.417","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/tags/1.1/dsgvo-google-web-fonts-gdpr.php#L159"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/tags/1.1/dsgvo-google-web-fonts-gdpr.php#L46"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/trunk/dsgvo-google-web-fonts-gdpr.php#L159"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/dsgvo-google-web-fonts-gdpr/trunk/dsgvo-google-web-fonts-gdpr.php#L46"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6203ffaf-5efd-4c66-85f0-cc3a05a03084?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@wordfence.com","type":"Secondary"}]}
|