GDPR Cookie Compliance CVE-2026-16613

The victim must be an authenticated or cookie-holding visitor to the targeted WordPress site and must be lured into loading a crafted URL (UI:R). The GDPR Cookie Compliance plugin must be installed and active on the target site. No special server configuration beyond plugin installation is required - the vulnerable action is exposed by default in all plugin versions before 5.1.0. Exploitation is limited to a session disruption effect; it does not grant the attacker any access, credentials, or persistent foothold. The attacker must know or discover that the target site uses this plugin, and the attack affects only the specific user who loads the crafted link, not all site users simultaneously.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) accurately reflects a moderate, user-interaction-dependent vulnerability with only an availability impact. EPSS at 0.12% (2nd percentile) confirms that automated, widespread exploitation is currently unlikely. The vulnerability is NOT in CISA KEV, and the impact is limited to session disruption - no data exfiltration and no code execution path exists. A publicly available exploit (via WPScan advisory) lowers the barrier to targeted harassment or coordinated nuisance attacks against specific WordPress sites, but does not meaningfully elevate the risk beyond the CVSS representation. Real-world priority is low for most organizations; administrators of high-traffic or politically targeted WordPress sites should prioritize the patch more urgently due to the ease of crafting functional attack URLs.

An attacker identifies a WordPress site running a vulnerable version of GDPR Cookie Compliance, constructs a URL that triggers the plugin's unauthenticated cookie-expiration action, and embeds it in a phishing email or forum post targeting the site's administrator or authenticated users. When the victim's browser loads the crafted link - even via a 1x1 pixel image tag - their WordPress session cookies are expired and they are silently logged out. A publicly available proof-of-concept is referenced in the WPScan advisory, making the construction of functional attack URLs straightforward.