What is the CVSS score of EUVD-2026-53107?

EUVD-2026-53107 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-53107?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53107. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-53107?

Yes, a patch is available for EUVD-2026-53107. Update the affected software to the latest version immediately.

GDPR Cookie Compliance EUVD-2026-53107

| CVE-2026-16613 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-05 WPScan

GHSA-crh8-vq8f-q88q

WordPress CSRF Gdpr Cookie Compliance Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF requiring victim interaction; no auth needed by attacker; impact is session disruption only, no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 20:27 vuln.today

CVSS changed

Aug 05, 2026 - 20:22 NVD

4.3 (MEDIUM)

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.

AnalysisAI

Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.

Technical ContextAI

GDPR Cookie Compliance (CPE: cpe:2.3:a:unknown:gdpr_cookie_compliance:*:*:*:*:*:*:*:*) is a WordPress plugin that manages cookie consent banners and associated cookie lifecycle operations. CWE-352 (Cross-Site Request Forgery) is the root cause: the server-side action responsible for expiring visitor cookies is registered without a WordPress nonce check and without validating the HTTP Referer or Origin header. Because the endpoint is reachable without authentication, any browser - including one belonging to an authenticated administrator - will execute the action when directed to the specially crafted URL. WordPress provides the wp_verify_nonce() API specifically to prevent this class of attack; its omission here is the direct defect.

RemediationAI

Update the GDPR Cookie Compliance plugin to version 5.1.0 or later immediately via the WordPress admin dashboard under Plugins > Installed Plugins > Update. This is the vendor-confirmed fix. If an immediate update is not possible, a compensating control is to temporarily deactivate the plugin, which removes the vulnerable endpoint from the attack surface at the cost of cookie consent banner functionality - a significant trade-off for sites with GDPR compliance obligations. Site administrators can also add a Web Application Firewall rule to block external requests targeting the plugin's cookie-expiration action endpoint as a short-term measure, though the exact endpoint path should be confirmed from WPScan's advisory at https://wpscan.com/vulnerability/d9511e8a-be67-4c39-b947-7931b5569ffb/ before configuring any rule.