The vulnerability is a CSRF flaw present in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent up to version 3.8.0 that allows an attacker to forge a state‑changing request. An unauthorized user could modify consent settings or other configuration values without the site administrator’s approval, potentially leading to incorrect cookie declarations and compliance issues.

The flaw affects the WordPress plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent, distributed by WP Legal Pages. It impacts all versions from the earliest released through 3.8.0.

With a CVSS score of 4.3 and an EPSS of <1 %, the vulnerability is moderate in severity but has a low exploitation probability. It is not listed in the CISA KEV catalog. The attack vector typically requires an ability to send a forged HTTP request to the target, often from an authenticated user or a third‑party site, to trigger a configuration change within the plugin. The conditions for exploitation are minimal, making the threat realistic albeit unlikely.