{
 "id": "WPSEC-2026-2752",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2752/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2752/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2752/index.md",
 "title": "The GDPR Framework By Data443 <= 2.5.2 - Unauthenticated Deletion of Other Customers' Purchase Data via Easy Digital Downloads Data Subject Erasure",
 "description": "The The GDPR Framework By Data443 plugin for WordPress is vulnerable to unintended deletion of other customers' purchase data via the Easy Digital Downloads data subject erasure in all versions up to, and including, 2.5.2. This is due to an incorrect type conversion in the edd_gdpr_delete_orders() function: the purchase-meta delete query formats the subject's email address with an integer placeholder (%d), which turns it into 0. MySQL's loose string-to-number comparison then matches the '_edd_payment_user_email' meta of almost every other payment, so all meta of those payments is deleted. This makes it possible for unauthenticated attackers who can verify themselves as a data subject through the Privacy Tools page (for example with an email address they used for a comment or purchase) to destroy purchase records belonging to other customers. The site must have Easy Digital Downloads compatibility enabled and the forget action set to delete.",
 "plugin": {
  "slug": "gdpr-framework",
  "name": "The GDPR Framework By Data443",
  "full_name": "The GDPR Framework By Data443",
  "wordpress_org": "https://wordpress.org/plugins/gdpr-framework/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gdpr-framework/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gdpr-framework"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-704"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.5.3",
 "remediation": "Update to 2.5.3 or later.",
 "fix_released": "2026-11-08T02:39:57+00:00",
 "published": "2026-11-09T02:41:57+00:00",
 "updated": "2026-11-08T13:12:46.077114+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2752/",
  "https://plugins.svn.wordpress.org/gdpr-framework/tags/2.5.3/",
  "https://wordpress.org/plugins/gdpr-framework/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gdpr-framework",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-09"
 }
}