ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3535

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the function in all versions up to,…

Published Apr 8, 2026 · updated Jul 24, 2026

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the function in all versions up to, and including, 1.1. The function is exposed via a hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 8, 2026 · NIST NVD

    Detected

    The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the function in all versions up to, and including, 1.1. The function is exposed via a hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without v

  2. Jul 24, 2026 · NIST NVD

    Updated

    The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the function in all versions up to, and including, 1.1. The function is exposed via a hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without v

Sources

  • CVE.orgVulnerability recordCVE-2026-3535

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3535

    The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the function in all versions up to, and including, 1.1. The function is exposed via a hook, requiri

    nvd.nist.gov

References