CVE-2026-3535

CriticalUpdated

Published: 08 April 2026

Published

08 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0037 58.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3535 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the missing file type validation in the DSGVOGWPdownloadGoogleFonts() function by requiring validation of user-supplied URLs and extracted file content to prevent arbitrary file uploads.

SI-3 Malicious Code Protection good match

preventdetect

Deploys malicious code protection at web server entry points to scan and eradicate PHP webshells uploaded to publicly accessible directories, mitigating remote code execution.

CM-7 Least Functionality good match

prevent

Restricts WordPress to least functionality by disabling unnecessary plugins like DSGVO Google Web Fonts GDPR or their unauthenticated AJAX hooks, eliminating the vulnerable endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated arbitrary file upload to a web-accessible directory, enabling exploitation of public-facing applications (T1190) and deployment of web shells for remote code execution (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_nopriv_`…

hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).

Deeper analysisAI

CVE-2026-3535 is an arbitrary file upload vulnerability in the DSGVO Google Web Fonts GDPR plugin for WordPress, affecting all versions up to and including 1.1. The issue stems from missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function, which is exposed via a `wp_ajax_nopriv_` hook that requires no authentication. This function fetches a user-supplied URL treated as a CSS file, extracts embedded URLs from its content, and downloads those files directly to a publicly accessible directory.

Unauthenticated attackers can exploit this vulnerability by providing a malicious CSS file URL containing references to arbitrary files, such as PHP webshells. The downloaded files bypass validation and land in a web-accessible location, enabling remote code execution. Exploitation requires the target WordPress site to use one of the following specific themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Advisories reference the vulnerable code locations in the plugin's source, including line 159 and line 46 in both the 1.1 tag and trunk versions of `dsgvo-google-web-fonts-gdpr.php`. Additional details are available in Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/6203ffaf-5efd-4c66-85f0-cc3a05a03084?source=cve.