WordPress core's personal data export/erase tooling (Tools → Export/Erase Personal Data) is not logged at all, although it is exactly the kind of action compliance audits ask about.
Proposal
| Code |
Event |
Hook |
| 4200 |
Privacy export request created |
`wp_user_request_created` (filter by type) |
| 4201 |
Privacy erasure request created |
same, type `remove_personal_data` |
| 4202 |
Personal data export file generated |
`wp_privacy_personal_data_export_file` |
| 4203 |
Personal data erased / request completed |
`wp_user_request_action_confirmed` / completion hooks |
Severity: HIGH. Metadata: request ID, requester email/user, admin who actioned it.
WordPress core's personal data export/erase tooling (Tools → Export/Erase Personal Data) is not logged at all, although it is exactly the kind of action compliance audits ask about.
Proposal
Severity: HIGH. Metadata: request ID, requester email/user, admin who actioned it.