CVE-2024-3599 is a missing authorization vulnerability (CWE-862) in the WP Cookie Consent plugin (WPLP Cookie Consent) for WordPress. The vulnerability arises from the absence of a capability check in the gdpr_policy_process_delete() function, enabling unauthenticated attackers to delete arbitrary posts. This affects all versions up to and including 3.0.2. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with no privileges required and no user interaction, causing availability impact (loss of data).

An unauthenticated attacker can delete arbitrary posts on a WordPress site using the vulnerable plugin, resulting in potential data loss. There is no confidentiality or integrity impact reported. The availability impact is limited to loss of posts. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, administrators should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to vulnerable plugin functionality or disabling the plugin if feasible to prevent exploitation.