CVE-2026-91828: OMGF WordPress Plugin DoS Vulnerability

CVE-2026-91828 Overview

CVE-2026-91828 affects the OMGF (GDPR/DSGVO Compliant, Faster Google Fonts) WordPress plugin in versions before 6.3.11. The plugin exposes an action that triggers a slow server-side loopback request without requiring authentication or a valid nonce. Unauthenticated attackers can repeatedly invoke this action to exhaust the PHP worker pool. Once workers are saturated, the site stops responding to legitimate requests, producing a full availability outage. The vulnerability is categorized as uncontrolled resource consumption [CWE-400].

Critical Impact

Remote unauthenticated attackers can take affected WordPress sites fully offline by exhausting PHP workers through repeated loopback requests.

Affected Products

• OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin
• All versions prior to 6.3.11
• WordPress sites running the plugin with default configuration

Discovery Timeline

• 2026-10-02 - CVE-2026-91828 published to the National Vulnerability Database
• 2026-10-02 - Last updated in the NVD database

Technical Details for CVE-2026-91828

Vulnerability Analysis

The OMGF plugin registers an action handler that initiates a server-side loopback HTTP request back to the WordPress instance. The handler does not verify a nonce and does not check for an authenticated session. Any remote client can invoke the action directly over the network. Each invocation ties up a PHP-FPM worker for the duration of the loopback request. When requests are issued in parallel, the worker pool fills quickly and the web server stops accepting new connections for any URL on the site.

This is a classic unauthenticated resource exhaustion issue [CWE-400]. The attack produces no payload execution and no data disclosure, but it fully denies availability.

Root Cause

The root cause is missing access control on an expensive action. The plugin trusts the request without validating wp_verify_nonce() output or confirming is_user_logged_in() and capability checks. Combined with a slow outbound HTTP call made from the request path, the handler becomes a reliable amplifier for worker exhaustion.

Attack Vector

Exploitation requires only network reachability to the WordPress site. An attacker sends concurrent HTTP requests to the vulnerable action endpoint exposed by the plugin. The server-side loopback request keeps each PHP worker occupied, and sustained request volume prevents the pool from recovering. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-91828

Indicators of Compromise

• Repeated unauthenticated POST or GET requests to the OMGF plugin action endpoint from a small set of source IPs
• PHP-FPM or Apache worker pool saturation alerts coinciding with inbound traffic to wp-admin/admin-ajax.php or admin-post.php referencing OMGF actions
• Elevated outbound loopback HTTP traffic from the web server to itself

Detection Strategies

• Baseline normal request rates to WordPress admin action endpoints and alert on unauthenticated spikes
• Correlate web server access logs with PHP worker queue depth and 502/504 error rates
• Flag concurrent requests to OMGF action handlers that lack a valid session cookie or nonce parameter

Monitoring Recommendations

• Monitor PHP-FPM pool metrics including active workers, listen queue length, and slow request counts
• Track response time distributions on WordPress endpoints and alert on sustained latency increases
• Ingest WordPress and web server logs into a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2026-91828

Immediate Actions Required

• Upgrade the OMGF plugin to version 6.3.11 or later on all WordPress sites
• Inventory WordPress installations to identify every instance of the vulnerable plugin
• Rate-limit requests to admin-ajax.php and admin-post.php at the reverse proxy or web application firewall

Patch Information

The vendor has released OMGF version 6.3.11, which adds authentication and nonce verification to the affected action. Apply the update through the WordPress plugin manager or by replacing plugin files directly. Validate the installed version after upgrade. See the WPScan Vulnerability Report for advisory details.

Workarounds

• Deactivate and remove the OMGF plugin until the patched version can be deployed
• Block unauthenticated access to the affected action endpoint using WAF rules
• Enforce aggressive connection and request rate limits at the edge for repeated hits to the plugin endpoint

# Example nginx rate limiting for WordPress action endpoints
limit_req_zone $binary_remote_addr zone=wp_action:10m rate=5r/s;

location ~ ^/wp-admin/(admin-ajax|admin-post)\.php$ {
    limit_req zone=wp_action burst=10 nodelay;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}