Cyber Resilience

CVE-2018-19207

Van-Ons Wp-Gdpr-Compliance ≤ 1.4.3

Public PoCHigh EPSS
Published
12 November 2018
Modified
21 November 2024
Patch / advisory
CVSS Score v3 9.8
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.88 99.8th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2018-19207 is a critical-severity Forced Browsing (CWE-425) vulnerability in Van-Ons Wp-Gdpr-Compliance. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability allows remote attackers to execute arbitrary code via a public-facing WordPress plugin, directly mapping to exploitation of a public-facing application.
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Arbitrary code execution via SQL mishandling can enable command or script interpreter execution on the server.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-0334Same product class: WordPress / CMS plugin
CVE-2024-12852Same product class: WordPress / CMS plugin
CVE-2024-9109Same product class: WordPress / CMS plugin
CVE-2024-2791Same product class: WordPress / CMS plugin
CVE-2023-46783Same product class: WordPress / CMS plugin
CVE-2023-6090Same product class: WordPress / CMS plugin
CVE-2023-0695Same product class: WordPress / CMS plugin
CVE-2024-5189Same product class: WordPress / CMS plugin
CVE-2023-6626Same product class: WordPress / CMS plugin
CVE-2024-32087Same product class: WordPress / CMS plugin

Affected Assets

van-ons
wp-gdpr-compliance
≤ 1.4.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-425

Forcing a decision on every access request, including direct ones, reduces the exploitability of forced browsing by ensuring no unchecked access paths.

addresses: CWE-425

Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks.

addresses: CWE-425

Enforcing access for all logical requests prevents unauthorized direct access to protected resources.

addresses: CWE-425

Displaying the notification before further access on public systems prevents direct resource requests from bypassing the required system use terms and consent.

addresses: CWE-425

Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.

addresses: CWE-425

Blocks unauthorized direct requests or forced browsing by denying input access to non-authorized actors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly requires policy-driven definition, enforcement, and review of authorizations on resources such as URLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes preventing direct requests to restricted paths.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect forced-browsing flaws, but the control itself does not prevent them in production.

prevents

Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.

prevents

Access control policy directly requires authorization checks on all resources, preventing forced browsing.

degrades

Managing access rights ensures every URL/script/file is explicitly authorized, mitigating direct request attacks.

degrades

Privileged access rights control enforces least-privilege checks on restricted endpoints.

prevents

Secure SDLC can include authorization design, yet the control itself does not guarantee runtime enforcement.

References