CVE-2026-14816 is an improper access control vulnerability (CWE-284) in The GDPR Framework By Data443 WordPress plugin before version 2.4.0. The plugin fails to properly verify authorization or the identity of the data subject when handling cookie-consent choices and privacy requests. This allows unauthenticated attackers to create forged consent records for arbitrary email addresses and to overwhelm the privacy-request queue with arbitrary entries, potentially impacting the site's privacy management functionality.

The vulnerability allows unauthenticated attackers to manipulate consent records and privacy requests, which can lead to denial of service by flooding the privacy-request queue and integrity issues by forging consent records. There is no direct confidentiality impact reported. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should monitor for unusual activity related to privacy requests and consider restricting access or applying custom access controls if possible. Avoid relying on the plugin for critical privacy consent enforcement until patched.