Threats tagged 'ghsa-xw6w-vrqp-fhq4'

The webtoffee-cookie-consent WordPress plugin before version 3.5.3 contains missing authorization checks on multiple REST API routes. This flaw allows unauthenticated attackers to export and delete visitor consent records, create posts, and modify the plugin's licensing state. The vulnerability is tracked as CVE-2026-13389 and has a medium severity rating with a CVSS score of 6.5.