The Gdpr Framework By Data443
Monthly
Unauthenticated consent-record forgery and privacy-queue flooding affect GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0. The plugin fails to verify the identity of the data subject or check authorization when recording cookie-consent choices and processing privacy requests, allowing any unauthenticated remote attacker to submit fraudulent GDPR consent records on behalf of arbitrary email addresses and to inject unlimited entries into the site's privacy-request queue. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in the CISA KEV catalog, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation at time of analysis.
Unauthenticated consent-record forgery and privacy-queue flooding affect GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0. The plugin fails to verify the identity of the data subject or check authorization when recording cookie-consent choices and processing privacy requests, allowing any unauthenticated remote attacker to submit fraudulent GDPR consent records on behalf of arbitrary email addresses and to inject unlimited entries into the site's privacy-request queue. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in the CISA KEV catalog, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation at time of analysis.