CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the gdpr_delete_policy_data function in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, attachments, and other post types by ID.
Explanation of Vulnerability in Simple Terms
The Cookie Banner for GDPR / CCPA plugin for WordPress does not properly check user permissions before allowing certain actions. An attacker without authentication can modify cookie consent settings or related data on affected sites. This affects versions 4.0.7 and earlier. Site owners should update to a version newer than 4.0.7 as soon as a patch is available.
What an attacker can do
Modify cookie consent settings or data without needing to log in.
Potential impact on your site
Attackers can alter your site's cookie consent configuration, potentially breaking GDPR/CCPA compliance or redirecting users.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
