CVE-2018-19207: WP GDPR Compliance plugin allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, confirmed in-the-wild exploitation, and an EPSS score near 0.88 make this an urgent patch.

What it is

The Van Ons WP GDPR Compliance plugin before 1.4.3 for WordPress mishandles input passed to $wpdb->prepare(), allowing remote attackers to execute arbitrary code. The flaw was exploited in the wild in November 2018, and the plugin is widely deployed on WordPress sites handling GDPR consent flows.

Impact

An unauthenticated attacker can run arbitrary code on the affected WordPress host, leading to full site compromise, data theft, or use of the server as a foothold.

Attack surface

Reachable over the network through the plugin's WordPress endpoints; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N).

Exploitation

Exploited in the wild in November 2018 per the description, and reference tags include Exploit; the CVE is not in CISA KEV, but EPSS is 0.88 (99.8th percentile), indicating very high likelihood of exploitation activity.

What to do

• Update the WP GDPR Compliance plugin to version 1.4.3 or later immediately.
• If patching is not possible, deactivate and remove the plugin until it can be updated.
• Audit WordPress sites for the plugin and check for signs of compromise such as unexpected admin users, modified files, or outbound connections.
• Apply WAF rules blocking exploit attempts against the plugin's endpoints.
• Rotate WordPress salts, admin credentials, and any secrets stored on affected hosts after remediation.

Detection

• Search web server logs for requests to wp-gdpr-compliance plugin paths with suspicious parameters or SQL-like payloads.
• Monitor for unexpected PHP file creation or modification in WordPress plugin, upload, and theme directories.
• Alert on new or modified WordPress administrator accounts and unexpected scheduled tasks (cron) after plugin exposure.
• Review outbound network connections from the web server for command-and-control or exfiltration patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.