CVE-2026-4019 describes a missing authorization vulnerability (CWE-862) in the Complianz – GDPR/CCPA Cookie Consent WordPress plugin. The REST API endpoint /wp-json/complianz/v1/consent-area/{post_id}/{block_id} uses __return_true as its permission callback, effectively allowing any unauthenticated user to access it. The function cmplz_rest_consented_content() retrieves a post by ID and returns the consentedContent attribute from any complianz/consent-area block found, without checking if the post is published or if the user has permission to read it. This results in unauthorized data disclosure from private, draft, or unpublished posts. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can read consent area block content from posts that are private, drafts, or unpublished without authentication or authorization. This leads to unauthorized disclosure of potentially sensitive or unpublished information contained in these posts. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — no official fix or vendor advisory is available at this time. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider restricting access to the REST API or disabling the Complianz consent-area REST endpoint if feasible to reduce exposure.