CVE-2024-11069: Welaunch WordPress Gdpr

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users.

Affected products

• Welaunch WordPress Gdpr: before 2.0.3 (fixed in 2.0.3)

Published 2024-11-19. Last modified 2026-06-17.