The webtoffee-cookie-consent plugin prior to version 3.5.3 lacks authorization checks on several REST API routes, allowing any unauthenticated user to export and delete stored visitor consent records, create new posts, and alter the plugin’s licensing state. The exposed endpoints enable direct information disclosure of sensitive consent information, irreversible data loss, unauthorized content creation, and potential service disruption if the license is deactivated.

The vulnerability affects WordPress sites that have the webtoffee-cookie-consent plugin installed in a pre‑3.5.3 release. Any site using the unpatched plugin is susceptible, regardless of its content or traffic size.

EPSS indicates a probability of exploitation of less than 1%, and the vulnerability is not listed in CISA KEV. Nevertheless, the absence of authentication on the REST routes means the attack vector is the public API; an attacker can perform the actions entirely over HTTP without credentials. The CVSS score of 6.5 indicates a medium severity, yet the potential for data loss, content manipulation, and license tampering remains significant for affected installations.