The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress suffers a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce verification on the adminEnableGdprAjax() function. This defect allows an unauthenticated attacker to modify GDPR settings, potentially changing how user data is handled or disclosed. The weakness is categorized as CWE‑352 and may compromise the integrity of the site’s privacy compliance.

All installations of the PixelYourSite plugin for WordPress with a version number of 11.1.2 or earlier are affected. The vulnerability exists in the admin interface that manages GDPR options; any site running those plugin versions could be impacted if an attacker convinces an administrator to follow a forged link.

The CVSS score for this vulnerability is 4.3, indicating a moderate risk. The EPSS score is below 1%, and it is not listed in CISA’s KEV catalog, suggesting exploitation activity is unlikely at present. However, the attack vector relies on a CSRF attack, so an adversary needs to trick an administrator into clicking a malicious link; once that occurs, they can change GDPR settings without any authentication.