{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24539", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:31:40.821Z", "datePublished": "2026-01-23T14:28:51.673Z", "dateUpdated": "2026-04-28T16:14:48.808Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "proteccion-datos-rgpd", "product": "Protecci\u00f3n de datos \u2013 RGPD", "vendor": "ABCdatos", "versions": [{"changes": [{"at": "0.69", "status": "unaffected"}], "lessThanOrEqual": "0.68", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:57.172Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in ABCdatos Protecci\u00f3n de datos \u2013 RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Protecci\u00f3n de datos \u2013 RGPD: from n/a through <= 0.68.</p>"}], "value": "Missing Authorization vulnerability in ABCdatos Protecci\u00f3n de datos \u2013 RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protecci\u00f3n de datos \u2013 RGPD: from n/a through <= 0.68."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:48.808Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/proteccion-datos-rgpd/vulnerability/wordpress-proteccion-de-datos-rgpd-plugin-0-68-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Protecci\u00f3n de datos \u2013 RGPD plugin <= 0.68 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T16:59:59.880754Z", "id": "CVE-2026-24539", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:16:43.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T16:59:59.880754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T16:59:55.481Z"}}], "cna": {"title": "WordPress Protecci\u00f3n de datos \u2013 RGPD plugin <= 0.68 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ABCdatos", "product": "Protecci\u00f3n de datos &#8211; RGPD", "versions": [{"status": "affected", "changes": [{"at": "0.69", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "0.68"}], "packageName": "proteccion-datos-rgpd", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:57.172Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/proteccion-datos-rgpd/vulnerability/wordpress-proteccion-de-datos-rgpd-plugin-0-68-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ABCdatos Protecci\u00f3n de datos &#8211; RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protecci\u00f3n de datos &#8211; RGPD: from n/a through <= 0.68.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in ABCdatos Protecci\u00f3n de datos &#8211; RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Protecci\u00f3n de datos &#8211; RGPD: from n/a through <= 0.68.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:05.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24539", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:16:43.574Z", "dateReserved": "2026-01-23T12:31:40.821Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:28:51.673Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in ABCdatos Protecci\u00f3n de datos \u2013 RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protecci\u00f3n de datos \u2013 RGPD: from n/a through <= 0.68."}, {"lang": "es", "value": "Vulnerabilidad de Falta de Autorizaci\u00f3n en ABCdatos Protecci\u00f3n de datos \u2013 RGPD proteccion-datos-rgpd permite Explotar Niveles de Seguridad de Control de Acceso Mal Configurados. Este problema afecta a Protecci\u00f3n de datos \u2013 RGPD: desde n/a hasta &lt;= 0.68."}], "id": "CVE-2026-24539", "lastModified": "2026-04-28T19:36:49.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-23T15:16:10.050", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/proteccion-datos-rgpd/vulnerability/wordpress-proteccion-de-datos-rgpd-plugin-0-68-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-29T00:56:35.828179+00:00", "value": {"mitigation_remediation": ["Upgrade ABCdatos Protecci\u00f3n de datos \u2013 RGPD plugin to a released version newer than 0.68 that fixes the authorization issue.", "If the plugin is not required, remove or disable it to eliminate the exposure.", "Restrict WordPress role permissions so only trusted administrators can install or modify plugins, reducing the chance that a malicious actor can leverage the flaw."], "summary": {"action": "Apply Patch", "impact": "Unauthorized access to sensitive data via missing authorization"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the ABCdatos Protecci\u00f3n de datos \u2013 RGPD plugin, version 0.68 or earlier. No other vendors or products are specifically mentioned as affected.", "description_and_impact": "The vulnerability is a missing authorization flaw that permits unauthorized users to access protected data handled by ABCdatos Protecci\u00f3n de datos \u2013 RGPD. This issue arises from incorrectly configured access control security levels, allowing exploitation without proper role validation. The flaw could expose personal information, potentially breaching GDPR obligations. It is categorized as CWE\u2011862 Incorrect Authorization.", "risk_and_exploitability": "The reported CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through web interfaces or plugin endpoints that lack proper permission checks, requiring authentication but not validating the actor\u2019s role. Successful exploitation would grant access to data protected by the plugin, potentially revealing personal information."}}}}, "created": "2026-01-26T11:54:38.127518+00:00", "updated": "2026-04-29T01:00:11.407010+00:00", "vendors": ["clickdatos", "clickdatos$PRODUCT$proteccion_de_datos_rgpd", "wordpress", "wordpress$PRODUCT$wordpress"]}