Privacy Policy Generator Terms Conditions Gdpr Ccpa Cookie Policy Disclaimer Templates
Monthly
Unauthenticated access to a missing-authorization REST endpoint in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 exposes the site's connected compliance-service API secret and account credentials to any visitor. Using the retrieved secret, an attacker can call the connected third-party compliance service API to sever the plugin's integration, causing GDPR, CCPA, and cookie policy documents to stop displaying on the affected WordPress site. A public exploit exists per WPScan, though CISA has not listed this in KEV and SSVC rates active exploitation as none at time of analysis.
Unauthenticated access to a missing-authorization REST endpoint in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 exposes the site's connected compliance-service API secret and account credentials to any visitor. Using the retrieved secret, an attacker can call the connected third-party compliance service API to sever the plugin's integration, causing GDPR, CCPA, and cookie policy documents to stop displaying on the affected WordPress site. A public exploit exists per WPScan, though CISA has not listed this in KEV and SSVC rates active exploitation as none at time of analysis.