CVE-2026-14816

The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam

View on CVE.org
Published Aug 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

Analysis

AI-generated

Technical impact

The GDPR Framework WordPress plugin by Data443 in versions before 2.4.0 fails to properly verify authorization when recording cookie‑consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and submit arbitrary entries to the site’s privacy‑request queue, thereby tampering with user consent data. It is inferred that this could disrupt normal site operation.

Affected Systems

All installations of the GDPR Framework plugin by Data443 on WordPress sites using a version earlier than 2.4.0 are affected.

Risk and Exploitability

Based on the description, it is inferred that the attack vector is remote via unauthenticated HTTP requests to the plugin’s consent and privacy‑request endpoints. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the CVSS score of 6.5 classifies the vulnerability as Medium severity. The lack of listing in the CISA KEV catalog suggests limited real‑world exploitation; the primary risk is to data integrity and availability for sites that rely on this plugin without additional access controls.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the GDPR Framework plugin to version 2.4.0 or later to apply the vendor‑provided authorization checks that correct the broken access control (CWE‑284) flaw.
  • If an immediate upgrade cannot be performed, enforce strict access controls on the consent and privacy‑request endpoints—restrict these routes to authenticated users only or apply IP whitelisting to mitigate the exposed CWE‑284 vulnerability.
  • Deploy a web‑application‑firewall rule that blocks unauthorized POST requests to the consent and privacy‑request endpoints, thereby preventing unauthorized access and spam entries that stem from the CWE‑284 flaw.

Generated by OpenCVE AI on August 4, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Data443
Data443 gdpr Framework
Wordpress
Wordpress wordpress
Vendors & Products Data443
Data443 gdpr Framework
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Weaknesses CWE-639
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-284
CWE-639
Type Values Removed Values Added
Description The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.
Title The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Aug 4, 2026, 2:26 PM
Reserved
Jul 6, 2026, 8:13 AM

View source JSON

Updated
Aug 4, 2026, 2:25 PM

JSON

Status
Deferred
Published
Aug 4, 2026, 7:16 AM
Modified
Aug 26, 2026, 4:31 PM

View source JSON

No data.

Updated
Aug 5, 2026, 9:45 AM

JSON