CVE-2026-16984: CWE-284 Improper Access Control in Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin versions prior to 3.7.1 lack an authorization check on a REST API endpoint that returns stored account data. This improper access control (CWE-284) allows unauthenticated visitors to retrieve sensitive information such as the API secret and account details of the connected service. The exposed credentials can be used to disrupt the plugin's integration by disconnecting it from the service. The CVSS v3.1 base score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact.

An attacker can retrieve sensitive API secrets and account details without authentication, potentially allowing them to disconnect the plugin's integration with the connected service. This could disrupt functionality relying on this integration. The confidentiality impact is low, and integrity impact is none, but availability impact is low due to possible disconnection.

No official patch or remediation level is currently confirmed. Users should upgrade to version 3.7.1 or later once available, as the vulnerability affects versions before 3.7.1. Until a fix is confirmed, restrict access to the REST API endpoints if possible or monitor for suspicious activity related to this plugin. Check the vendor advisory for updates on patch availability.