EUVD-2026-52584
GHSA-gjf2-7v5h-4jf9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-accessible unauthenticated endpoints with no complexity barrier; impacts limited to low-severity consent-record forgery (I:L) and queue flooding (A:L); no confidentiality exposure and scope unchanged.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.
AnalysisAI
Unauthenticated consent-record forgery and privacy-queue flooding affect GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0. The plugin fails to verify the identity of the data subject or check authorization when recording cookie-consent choices and processing privacy requests, allowing any unauthenticated remote attacker to submit fraudulent GDPR consent records on behalf of arbitrary email addresses and to inject unlimited entries into the site's privacy-request queue. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in the CISA KEV catalog, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation at time of analysis.
Technical ContextAI
The affected software is a WordPress plugin (cpe:2.3:a:unknown:the_gdpr_framework_by_data443:*:*:*:*:*:*:*:*) designed to manage GDPR compliance workflows, including cookie-consent banners and data-subject privacy requests. The root cause is CWE-284 (Improper Access Control): the plugin's endpoints that handle consent recording and privacy-request submission perform no authorization checks and do not verify that the submitting party controls or owns the email address being acted upon. This is a classic broken object-level authorization pattern in a WordPress plugin - unauthenticated REST or form-submission endpoints accept arbitrary user-supplied email addresses as the data-subject identity without challenge, nonce validation, or ownership verification. The integrity impact is twofold: fraudulent consent audit trails that may violate a site's legal compliance posture, and denial-of-service against the privacy-request queue through bulk submission.
RemediationAI
Update the GDPR Framework By Data443 plugin to version 2.4.0 or later immediately; this is the vendor-released patched version per WPScan advisory (https://wpscan.com/vulnerability/72af92a2-afe6-4e5a-9a1a-6f6e97bbcd85/). If an immediate upgrade is not possible, a compensating control is to disable or password-protect the plugin's cookie-consent submission and privacy-request endpoints via a WAF rule or WordPress application firewall plugin - this carries the side effect of breaking the GDPR consent workflow for legitimate users. Alternatively, temporarily deactivating the plugin halts exposure entirely but removes GDPR compliance functionality. Given the low EPSS and the availability of a direct patch, upgrading to 2.4.0 is strongly preferred over workarounds.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today