EUVD-2026-51952
GHSA-xw6w-vrqp-fhq4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable REST API with no auth required (PR:N, AV:N); partial confidentiality and integrity impact from record export and post creation; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.
AnalysisAI
Unauthenticated REST API access in the webtoffee-cookie-consent WordPress plugin before 3.5.3 allows any network attacker to export or delete stored visitor consent records, create arbitrary WordPress posts, and alter the plugin's licensing state. All versions prior to 3.5.3 are affected with no special configuration required, as the missing permission callbacks expose endpoints to public access by default. A publicly available exploit exists per WPScan, though EPSS sits at 0.22% (12th percentile), indicating exploitation has not yet reached widespread automated abuse; no public exploit identified at time of analysis for active in-the-wild campaigns.
Technical ContextAI
The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw common in WordPress plugin development where REST API routes are registered without a permission_callback, causing WordPress core to treat them as publicly accessible. The affected product is identified by CPE cpe:2.3:a:unknown:webtoffee-cookie-consent:*:*:*:*:*:*:*:* covering all versions before 3.5.3 per EUVD-2026-51952. The plugin is a GDPR/ePrivacy cookie consent manager - its stored visitor consent records may carry regulatory compliance weight under GDPR and the ePrivacy Directive, meaning unauthorized deletion or export is not purely a technical concern but can also constitute a compliance incident.
RemediationAI
Update the webtoffee-cookie-consent WordPress plugin to version 3.5.3 or later, which introduces proper authorization checks on the previously unprotected REST API routes; the vendor-released patch is confirmed available. If immediate patching is not feasible, administrators can restrict external access to the plugin's REST API namespace (e.g., /wp-json/webtoffee-cookie-consent/) at the web server or WAF layer - note this workaround will disable plugin front-end functionality that depends on those routes. Alternatively, temporarily deactivating the plugin eliminates the exposure while maintaining the rest of the site, at the cost of losing active cookie consent banner functionality. The WPScan advisory at https://wpscan.com/vulnerability/a591c79d-5db7-4716-8b6c-004b1195edf7/ is the primary remediation reference.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today