CVE-2026-3535
Published: 08 April 2026
Summary
CVE-2026-3535 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-3535 is an arbitrary file upload vulnerability in the DSGVO Google Web Fonts GDPR plugin for WordPress, affecting all versions up to and including 1.1. The issue stems from missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function, which is exposed via a `wp_ajax_nopriv_` hook that requires no authentication. This function fetches a user-supplied URL treated as a CSS file, extracts embedded URLs from its content, and downloads those files directly to a publicly accessible directory.
Unauthenticated attackers can exploit this vulnerability by providing a malicious CSS file URL containing references to arbitrary files, such as PHP webshells. The downloaded files bypass validation and land in a web-accessible location, enabling remote code execution. Exploitation requires the target WordPress site to use one of the following specific themes: twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories reference the vulnerable code locations in the plugin's source, including line 159 and line 46 in both the 1.1 tag and trunk versions of `dsgvo-google-web-fonts-gdpr.php`. Additional details are available in Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/6203ffaf-5efd-4c66-85f0-cc3a05a03084?source=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20104
Vulnerability details
The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_nopriv_`…
more
hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated arbitrary file upload to a web-accessible directory, enabling exploitation of public-facing applications (T1190) and deployment of web shells for remote code execution (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing file type validation in the DSGVOGWPdownloadGoogleFonts() function by requiring validation of user-supplied URLs and extracted file content to prevent arbitrary file uploads.
Deploys malicious code protection at web server entry points to scan and eradicate PHP webshells uploaded to publicly accessible directories, mitigating remote code execution.
Restricts WordPress to least functionality by disabling unnecessary plugins like DSGVO Google Web Fonts GDPR or their unauthenticated AJAX hooks, eliminating the vulnerable endpoint.