CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
What the vulnerability does
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
Explanation of Vulnerability in Simple Terms
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.3 and earlier lack proper authorization checks. A logged-in user with low privileges can trigger a denial-of-service condition by making requests that degrade site availability. The vulnerability does not expose sensitive data or allow unauthorized modifications.
What an attacker can do
A low-privilege logged-in user can make requests that degrade site availability.
Potential impact on your site
Site availability may be degraded if a low-privilege user exploits this vulnerability.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
