CVE-2026-13389: CWE-862 Missing Authorization in webtoffee-cookie-consent
The webtoffee-cookie-consent WordPress plugin versions before 3.5.3 lack authorization checks on multiple REST API routes. This flaw allows unauthenticated attackers to export and delete visitor consent records, create posts, and alter the plugin's licensing state. No patch or official remediation guidance is currently provided. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
CVE-2026-13389 is a missing authorization vulnerability (CWE-862) in the webtoffee-cookie-consent WordPress plugin prior to version 3.5.3. The plugin fails to enforce authorization on several REST API endpoints, enabling unauthenticated attackers to perform sensitive actions including exporting and deleting stored visitor consent data, creating WordPress posts, and modifying the plugin's licensing state. This vulnerability could lead to unauthorized data manipulation and potential disruption of site functionality. No CVSS score or vendor patch information is currently available.
Potential Impact
An attacker without authentication can exploit this vulnerability to export and delete visitor consent records, create arbitrary posts on the WordPress site, and modify the licensing state of the plugin. This could result in unauthorized data exposure, data loss, content injection, and potential licensing or plugin misuse. The absence of authorization checks significantly increases the risk of unauthorized access and manipulation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints of the webtoffee-cookie-consent plugin where possible, and monitor for unusual activity related to visitor consent data and post creation. Avoid exposing these API routes publicly if feasible.
CVE-2026-13389: CWE-862 Missing Authorization in webtoffee-cookie-consent
Description
The webtoffee-cookie-consent WordPress plugin versions before 3.5.3 lack authorization checks on multiple REST API routes. This flaw allows unauthenticated attackers to export and delete visitor consent records, create posts, and alter the plugin's licensing state. No patch or official remediation guidance is currently provided. There are no known exploits in the wild at this time.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13389 is a missing authorization vulnerability (CWE-862) in the webtoffee-cookie-consent WordPress plugin prior to version 3.5.3. The plugin fails to enforce authorization on several REST API endpoints, enabling unauthenticated attackers to perform sensitive actions including exporting and deleting stored visitor consent data, creating WordPress posts, and modifying the plugin's licensing state. This vulnerability could lead to unauthorized data manipulation and potential disruption of site functionality. No CVSS score or vendor patch information is currently available.
Potential Impact
An attacker without authentication can exploit this vulnerability to export and delete visitor consent records, create arbitrary posts on the WordPress site, and modify the licensing state of the plugin. This could result in unauthorized data exposure, data loss, content injection, and potential licensing or plugin misuse. The absence of authorization checks significantly increases the risk of unauthorized access and manipulation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints of the webtoffee-cookie-consent plugin where possible, and monitor for unusual activity related to visitor consent data and post creation. Avoid exposing these API routes publicly if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-26T07:01:43.297Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6f99c8bf32cb7a344bd985
Added to database: 08/02/2026, 19:26:00 UTC
Last enriched: 08/02/2026, 19:26:41 UTC
Last updated: 08/02/2026, 21:31:35 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.