CVE-2026-24539: 
WordPress vulnerability analysis and mitigation

CVE-2026-24539 is a Missing Authorization (Broken Access Control) vulnerability in the ABCdatos "Protección de datos – RGPD" WordPress plugin. It affects all versions up to and including 0.68, allowing unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Nabil Irawan on December 25, 2025, and publicly disclosed by Patchstack on January 23–24, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to perform adequate authorization checks before executing privileged or sensitive actions. This allows an unauthenticated network attacker — with no user interaction required — to invoke functionality that should be restricted to higher-privileged users. The attack vector is network-based with low complexity, consistent with typical WordPress broken access control patterns where REST API endpoints or AJAX handlers lack nonce or capability checks (Patchstack).

Successful exploitation results in a low-integrity impact, allowing unauthenticated attackers to perform unauthorized actions within the plugin's scope — such as modifying GDPR/data protection settings or plugin configuration — without affecting confidentiality or availability. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact, though the unauthenticated, network-accessible nature of the flaw means it could be incorporated into automated WordPress scanning tools (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Protección de datos – RGPD" plugin version 0.68 or earlier using tools like WPScan, Shodan, or automated WordPress fingerprinting scripts.
2. Identify unprotected endpoints: Enumerate the plugin's registered AJAX actions or REST API endpoints (e.g., via the plugin's source code on WordPress.org) to locate functions lacking capability or nonce checks.
3. Craft unauthorized request: Send an unauthenticated HTTP POST or GET request directly to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php?action=<vulnerable_action> or the relevant REST route) without providing authentication credentials.
4. Execute privileged action: The missing authorization check allows the request to succeed, enabling the attacker to modify plugin settings, alter GDPR compliance configurations, or trigger other restricted plugin functionality (Patchstack).

• Network: Unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the proteccion-datos-rgpd plugin; unexpected REST API calls to plugin-registered routes from unknown or automated IP addresses.
• Logs: WordPress access logs showing repeated requests to plugin AJAX handlers without session cookies or authentication tokens; unusual modification timestamps on plugin-related database entries (e.g., wp_options rows prefixed with the plugin's namespace).
• File System: Unexpected changes to plugin configuration files or WordPress options stored in the database related to GDPR/data protection settings.

The vendor has released version 0.69 of the "Protección de datos – RGPD" plugin, which patches this vulnerability. Site administrators should update the plugin to version 0.69 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. If an immediate update is not possible, consider temporarily deactivating the plugin or using a web application firewall (WAF) rule to block unauthenticated requests to the plugin's AJAX/REST endpoints. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Coverage of this vulnerability has been limited to automated vulnerability digest publications and security aggregators. WP Firewall published a brief mitigation guide on January 26, 2026, and Red Packet Security included it in a weekly CISA vulnerability summary (WP Firewall). No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability disclosure channels.