Attack Chain

1. An unauthenticated attacker identifies a WordPress site using a vulnerable theme and the vulnerable plugin.
2. The attacker crafts a malicious CSS file hosted on a server they control. This CSS file contains URLs pointing to a PHP webshell.
3. The attacker sends a request to the WordPress site's wp-admin/admin-ajax.php endpoint, triggering the wp_ajax_nopriv_DSGVOGWPdownloadGoogleFonts action. The request includes a parameter pointing to the malicious CSS file.
4. The DSGVOGWPdownloadGoogleFonts() function fetches the attacker-controlled CSS file.
5. The function parses the CSS file and extracts the URLs, including the URL pointing to the PHP webshell.
6. The function downloads the PHP webshell to a publicly accessible directory within the WordPress installation, such as /wp-content/uploads/. Because of the missing validation, the PHP file is saved.
7. The attacker accesses the uploaded PHP webshell via a direct HTTP request to the file's location.
8. The attacker executes arbitrary commands on the server via the PHP webshell, gaining control of the WordPress site and potentially the underlying server.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP webshells, onto vulnerable WordPress installations. This leads to remote code execution, potentially granting the attacker complete control over the affected web server. The attacker can then steal sensitive data, deface the website, install malware, or use the compromised server as a launching point for further attacks. Given the widespread use of WordPress, a large number of websites are potentially vulnerable.

Recommendation

• Upgrade the DSGVO Google Web Fonts GDPR plugin to a version patched against CVE-2026-3535 to remediate the vulnerability.
• Implement the Sigma rule Detect WordPress Plugin Arbitrary File Upload Attempt to detect attempts to exploit this vulnerability by monitoring for requests to download files via the vulnerable function.
• Monitor web server logs for access to unusual files within the /wp-content/uploads/ directory, especially PHP files, as indicators of successful exploitation.
• Implement the Sigma rule Detect PHP Webshell Upload via DSGVO Google Web Fonts GDPR Plugin to detect the writing of php files to the uploads directory.
• Consider using a Web Application Firewall (WAF) to block requests targeting the wp_ajax_nopriv_DSGVOGWPdownloadGoogleFonts action.