CVE-2026-16613: CWE-352 Cross-Site Request Forgery (CSRF) in GDPR Cookie Compliance
CVE-2026-16613 is a Cross-Site Request Forgery (CSRF) vulnerability in the GDPR Cookie Compliance WordPress plugin before version 5.1.0. The flaw allows an attacker to log out any user and delete the site's cookies by tricking them into clicking a crafted link. This occurs because the plugin expires visitor cookies via an unauthenticated action without verifying the request origin. The vulnerability has a medium severity score of 4.3 and does not impact confidentiality or integrity but affects availability by causing user logouts.
AI Analysis
Technical Summary
The GDPR Cookie Compliance WordPress plugin versions prior to 5.1.0 contain a CSRF vulnerability (CWE-352) where an unauthenticated action expires visitor cookies without checking the request origin. This enables attackers to force users to be logged out and delete cookies by luring them to a maliciously crafted link. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). No official remediation or patch information is currently available, and no known exploits are reported in the wild.
Potential Impact
An attacker can cause denial of service to users by forcing them to be logged out and deleting their cookies, disrupting user sessions. There is no impact on confidentiality or integrity of data. The attack requires user interaction (clicking a crafted link) and can be performed remotely without authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about clicking untrusted links that could trigger this logout action. Monitor official vendor channels for updates or patches addressing this CSRF vulnerability.
CVE-2026-16613: CWE-352 Cross-Site Request Forgery (CSRF) in GDPR Cookie Compliance
Description
CVE-2026-16613 is a Cross-Site Request Forgery (CSRF) vulnerability in the GDPR Cookie Compliance WordPress plugin before version 5.1.0. The flaw allows an attacker to log out any user and delete the site's cookies by tricking them into clicking a crafted link. This occurs because the plugin expires visitor cookies via an unauthenticated action without verifying the request origin. The vulnerability has a medium severity score of 4.3 and does not impact confidentiality or integrity but affects availability by causing user logouts.
CVSS v3.1
Score 4.3medium
Affected software
GDPR Cookie Compliance
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GDPR Cookie Compliance WordPress plugin versions prior to 5.1.0 contain a CSRF vulnerability (CWE-352) where an unauthenticated action expires visitor cookies without checking the request origin. This enables attackers to force users to be logged out and delete cookies by luring them to a maliciously crafted link. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). No official remediation or patch information is currently available, and no known exploits are reported in the wild.
Potential Impact
An attacker can cause denial of service to users by forcing them to be logged out and deleting their cookies, disrupting user sessions. There is no impact on confidentiality or integrity of data. The attack requires user interaction (clicking a crafted link) and can be performed remotely without authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about clicking untrusted links that could trigger this logout action. Monitor official vendor channels for updates or patches addressing this CSRF vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T14:35:51.882Z
- State
- PUBLISHED
Threat ID: 6a72d7aebf8831d5395e82bc
Added to database: 08/05/2026, 06:26:54 UTC
Last enriched: 08/12/2026, 15:08:40 UTC
Last updated: 09/17/2026, 22:01:33 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.