The GDPR Framework By Data443 <= 2.5.2 - Unauthenticated Deletion of Other Customers' Purchase Data via Easy Digital Downloads Data Subject Erasure
- ID
- WPSEC-2026-2752
- Plugin
- The GDPR Framework By Data443 (gdpr-framework)
- Affected
- all versions before 2.5.3
- Remediation
- Update to 2.5.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
- Weakness
- CWE-704
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-09
- Attack surface
- The GDPR Framework By Data443 on WPSec AttackSurface
- Fix released
- Published
Description
The The GDPR Framework By Data443 plugin for WordPress is vulnerable to unintended deletion of other customers' purchase data via the Easy Digital Downloads data subject erasure in all versions up to, and including, 2.5.2. This is due to an incorrect type conversion in the edd_gdpr_delete_orders() function: the purchase-meta delete query formats the subject's email address with an integer placeholder (%d), which turns it into 0. MySQL's loose string-to-number comparison then matches the '_edd_payment_user_email' meta of almost every other payment, so all meta of those payments is deleted. This makes it possible for unauthenticated attackers who can verify themselves as a data subject through the Privacy Tools page (for example with an email address they used for a comment or purchase) to destroy purchase records belonging to other customers. The site must have Easy Digital Downloads compatibility enabled and the forget action set to delete.
References
- https://wpsec.com/vuln/WPSEC-2026-2752/
- https://plugins.svn.wordpress.org/gdpr-framework/tags/2.5.3/
- https://wordpress.org/plugins/gdpr-framework/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS