CVE-2026-3535: WordPress DSGVO Google Fonts RCE Flaw

CVE-2026-3535 Overview

The DSGVO Google Web Fonts GDPR plugin for WordPress contains a critical arbitrary file upload vulnerability in the DSGVOGWPdownloadGoogleFonts() function. This flaw exists in all versions up to and including 1.1 due to missing file type validation. The vulnerable function is exposed via a wp_ajax_nopriv_ hook, which means it requires no authentication to exploit.

The function fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This allows unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution (RCE). Exploitation requires the target site to use one of several specific themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely.

Critical Impact

Unauthenticated remote code execution via arbitrary file upload, allowing attackers to gain complete control over vulnerable WordPress installations.

Affected Products

• DSGVO Google Web Fonts GDPR plugin for WordPress versions up to and including 1.1
• WordPress sites using themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely

Discovery Timeline

• April 8, 2026 - CVE-2026-3535 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3535

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The core issue lies in the DSGVOGWPdownloadGoogleFonts() function which processes user-controlled input without proper security controls.

The attack flow works as follows: An attacker crafts a malicious CSS file hosted on an external server. This CSS file contains URL references that point to malicious PHP files (such as webshells) rather than legitimate font files. When the vulnerable function processes the attacker-supplied URL, it parses the CSS content, extracts these malicious URLs, and downloads the files to a publicly accessible directory on the WordPress server.

Because the function performs no validation on file types or content, PHP files are downloaded and stored alongside legitimate assets. The attacker can then directly access the uploaded PHP file via the web server, achieving remote code execution with the privileges of the web server user.

The use of the wp_ajax_nopriv_ hook is particularly dangerous as it exposes the vulnerable function to unauthenticated users, dramatically lowering the barrier to exploitation.

Root Cause

The root cause is the complete absence of file type validation in the DSGVOGWPdownloadGoogleFonts() function. The function blindly trusts user-supplied URLs and downloads any file type to a publicly accessible directory. Proper security controls should include:

1. Whitelist validation of allowed file extensions (e.g., .woff, .woff2, .ttf, .eot)
2. MIME type verification of downloaded content
3. Authentication requirements for the AJAX endpoint
4. Content validation to ensure downloaded files match expected formats

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Hosting a malicious CSS file on an attacker-controlled server
2. The CSS file references URLs pointing to PHP webshell files
3. Sending a crafted request to the vulnerable AJAX endpoint with the malicious CSS URL
4. The plugin downloads and stores the PHP files in a publicly accessible directory
5. The attacker accesses the uploaded webshell to execute arbitrary commands

The attack is constrained by theme requirements—the vulnerable code path only executes when specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely) are active. However, several of these are default WordPress themes, making many installations potentially vulnerable.

Detection Methods for CVE-2026-3535

Indicators of Compromise

• Unexpected PHP files appearing in the plugin's font download directory
• Web server logs showing requests to the wp_ajax_nopriv_DSGVOGWPdownloadGoogleFonts endpoint from external IPs
• POST requests containing external URLs in the AJAX endpoint parameters
• Webshell signatures or suspicious PHP files in publicly accessible directories
• Unusual outbound connections originating from the web server process

Detection Strategies

• Monitor WordPress AJAX endpoints for unauthenticated requests to DSGVOGWPdownloadGoogleFonts
• Implement file integrity monitoring on WordPress plugin directories to detect new PHP files
• Use Web Application Firewall (WAF) rules to block requests containing external URLs in font download parameters
• Deploy endpoint detection to identify webshell behavior patterns and unauthorized process spawning

Monitoring Recommendations

• Enable detailed logging for all WordPress AJAX requests and review regularly
• Configure alerts for new executable files created in plugin directories
• Monitor for command execution patterns typical of webshell activity (e.g., calls to system(), exec(), shell_exec())
• Implement network monitoring to detect unexpected external URL fetches from the WordPress application

How to Mitigate CVE-2026-3535

Immediate Actions Required

• Update the DSGVO Google Web Fonts GDPR plugin to a patched version (when available) immediately
• If no patch is available, deactivate and remove the plugin until a fix is released
• Audit the plugin's file directories for any unexpected PHP files and remove suspicious content
• Review web server logs for evidence of exploitation attempts
• Consider implementing a WAF rule to block requests to the vulnerable endpoint

Patch Information

Review the Wordfence Vulnerability Report for the latest patch status and remediation guidance. The vulnerable code can be examined at the WordPress Plugin Code repository for versions 1.1 and below.

Workarounds

• Disable the DSGVO Google Web Fonts GDPR plugin until a patched version is available
• Implement server-level restrictions to block external URL fetching from the plugin directory
• Use .htaccess or server configuration to deny direct PHP execution in the plugin's font directories
• Deploy a Web Application Firewall with rules to block the vulnerable AJAX action

# Apache .htaccess to prevent PHP execution in plugin uploads directory
# Add to wp-content/plugins/dsgvo-google-web-fonts-gdpr/.htaccess

<FilesMatch "\.php$">
    Order Deny,Allow
    Deny from all
</FilesMatch>