Webtoffee Cookie Consent
Monthly
Unauthenticated REST API access in the webtoffee-cookie-consent WordPress plugin before 3.5.3 allows any network attacker to export or delete stored visitor consent records, create arbitrary WordPress posts, and alter the plugin's licensing state. All versions prior to 3.5.3 are affected with no special configuration required, as the missing permission callbacks expose endpoints to public access by default. A publicly available exploit exists per WPScan, though EPSS sits at 0.22% (12th percentile), indicating exploitation has not yet reached widespread automated abuse; no public exploit identified at time of analysis for active in-the-wild campaigns.
Unauthenticated REST API access in the webtoffee-cookie-consent WordPress plugin before 3.5.3 allows any network attacker to export or delete stored visitor consent records, create arbitrary WordPress posts, and alter the plugin's licensing state. All versions prior to 3.5.3 are affected with no special configuration required, as the missing permission callbacks expose endpoints to public access by default. A publicly available exploit exists per WPScan, though EPSS sits at 0.22% (12th percentile), indicating exploitation has not yet reached widespread automated abuse; no public exploit identified at time of analysis for active in-the-wild campaigns.