CVE-2026-13389 is a missing authorization vulnerability (CWE-862) in the webtoffee-cookie-consent WordPress plugin versions prior to 3.5.3. The plugin fails to enforce authorization on several REST API endpoints, enabling unauthenticated attackers to perform sensitive actions such as exporting and deleting stored visitor consent data, creating WordPress posts, and altering the plugin's licensing state. This lack of access control can lead to unauthorized data manipulation and potential disruption of site functionality.

An attacker without authentication can exploit this vulnerability to access and delete visitor consent records, create arbitrary posts on the WordPress site, and modify the licensing state of the plugin. This can result in data loss, unauthorized content creation, and potential license misuse. The CVSS 3.1 base score is 6.5 (medium), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor the vendor's announcements for updates. Until a patch is available, restricting access to the REST API endpoints or disabling the plugin if feasible may reduce exposure.