EUVD-2026-26200Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated REST endpoint; no interaction required; impact limited to partial confidentiality of consent-area block attributes only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Complianz - GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated user to access it. The cmplz_rest_consented_content() function retrieves a post by ID via get_post() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers to read the consent area block content from private, draft, or unpublished posts.
AnalysisAI
Unauthorized post content disclosure in the Complianz - GDPR/CCPA Cookie Consent WordPress plugin (all versions up to and including 7.4.5) allows unauthenticated remote attackers to read consent-area block content from private, draft, and unpublished posts via a REST API endpoint that bypasses all access controls. The root cause is CWE-862 (Missing Authorization): the endpoint registers WordPress's built-in __return_true as its permission callback, unconditionally permitting all callers regardless of authentication or capability. Real-world exploitation probability is very low (EPSS 0.03%, 10th percentile), no public exploit has been identified, and the SSVC assessment confirms no observed exploitation - though the attack is trivially automatable against any site running the plugin.
Technical ContextAI
The vulnerability resides in the WordPress REST API layer of the Complianz - GDPR/CCPA Cookie Consent plugin. The rest-api/rest-api.php file registers the endpoint /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using WordPress's register_rest_route(), with __return_true supplied as the permission_callback - a WordPress built-in that unconditionally returns true, effectively disabling all capability and authentication enforcement for that route. The cmplz_rest_consented_content() handler then calls get_post() with an attacker-supplied post_id, locates the first complianz/consent-area Gutenberg block parsed from the post content, and returns its consentedContent attribute without verifying publication status or caller permissions. Code-level evidence is confirmed in the WordPress plugin repository at tags/7.4.4.2, rest-api/rest-api.php lines 54 and 61. The root cause class is CWE-862 (Missing Authorization): the designated WordPress mechanism for REST API access control was set to always permit access. All Complianz GDPR plugin versions from 0 through 7.4.5 are affected.
RemediationAI
Update the Complianz - GDPR/CCPA Cookie Consent plugin to version 7.4.6 or later; the fix is evidenced by the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fcomplianz-gdpr/tags/7.4.5&new_path=%2Fcomplianz-gdpr/tags/7.4.6, which modifies rest-api/rest-api.php to replace the __return_true permission callback with a proper capability check. The specific fix commit is also visible at https://plugins.trac.wordpress.org/changeset/3508713/complianz-gdpr/trunk/rest-api/rest-api.php. The exact fix version (7.4.6) is inferred from the changeset reference rather than an explicit vendor release advisory; administrators should confirm the version available in the WordPress plugin repository before deploying. If immediate upgrade is not feasible, a compensating control is to add a WordPress rest_pre_dispatch filter or Web Application Firewall rule blocking unauthenticated requests to the path /wp-json/complianz/v1/consent-area/*; note that this may break legitimate front-end consent-rendering functionality that relies on the endpoint and should be tested in a staging environment before production deployment. Additional advisory context is available at Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/3892489e-6ff7-4664-bb06-b8edff6dd659) and VulDB (https://vuldb.com/vuln/360108).
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today