CVE-2025-14061

Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

View on CVE.org
Published Dec 17, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the gdpr_delete_policy_data function in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, attachments, and other post types by ID.

Analysis

AI-generated

Technical impact

The WordPress plugin misimplements the gdpr_delete_policy_data function by omitting a capability check, allowing an unauthenticated user to trigger permanent deletion of any post, page, or attachment by supplying its ID. This flaw is classified as a missing authorization weakness (CWE-862), leading to integrity loss of site content and potentially site disruption.

Affected Systems

The vulnerability affects the wplegalpages "Cookie Banner for GDPR / CCPA – WPLP Cookie Consent" plugin up to and including version 4.0.7. Any installation of this plugin before the fix is susceptible.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity. An EPSS score of less than 1% points to a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves an unauthenticated HTTP request targeting the vulnerable function, passing the identifier of any desired post type for deletion.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WP Cookie Consent plugin to the latest version that includes the missing capability check.
  • If an update is not immediately possible, disable the plugin or the gdpr_delete_policy_data endpoint to block unauthenticated deletion attempts.
  • As a temporary fix, inspect the plugin code and introduce an explicit capability check (for example, require the current user to have the "manage_options" capability) before executing any deletion logic.

Generated by OpenCVE AI on April 22, 2026 at 00:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wplegalpages
Wplegalpages wp Cookie Consent
Vendors & Products Wordpress
Wordpress wordpress
Wplegalpages
Wplegalpages wp Cookie Consent
Type Values Removed Values Added
Description The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the gdpr_delete_policy_data function in all versions up to, and including, 4.0.7. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, attachments, and other post types by ID.
Title Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Apr 8, 2026, 5:04 PM
Reserved
Dec 4, 2025, 8:05 PM

View source JSON

Updated
Dec 17, 2025, 9:34 PM

JSON

Status
Deferred
Published
Dec 17, 2025, 7:15 AM
Modified
Sep 28, 2026, 10:10 AM

View source JSON

No data.

Updated
Apr 22, 2026, 12:15 AM

JSON