CVE-2025-14061 is a missing authorization vulnerability (CWE-862) in the WP Cookie Consent plugin for WordPress (wplegalpages project). The issue arises from the lack of a capability check in the gdpr_delete_policy_data function, enabling unauthenticated attackers to permanently delete arbitrary WordPress content by specifying post IDs. This affects all plugin versions up to and including 4.0.7. The vulnerability is remotely exploitable without authentication and requires low attack complexity. The impact is limited to integrity loss (unauthorized deletion) without confidentiality or availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker can permanently delete arbitrary posts, pages, attachments, and other post types by ID without authentication. This compromises the integrity of the affected WordPress site content. There is no direct impact on confidentiality or availability according to the CVSS vector. The medium severity reflects the potential for content loss but not system takeover or data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting access to the plugin's functionality or disabling it if feasible. Monitoring for suspicious deletion activity may help detect exploitation attempts. Avoid exposing the vulnerable plugin to untrusted users or the public internet where possible.