The GDPR Framework WordPress plugin by Data443 in versions before 2.4.0 fails to properly verify authorization when recording cookie‑consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and submit arbitrary entries to the site’s privacy‑request queue, thereby tampering with user consent data. It is inferred that this could disrupt normal site operation.

All installations of the GDPR Framework plugin by Data443 on WordPress sites using a version earlier than 2.4.0 are affected.

Based on the description, it is inferred that the attack vector is remote via unauthenticated HTTP requests to the plugin’s consent and privacy‑request endpoints. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the CVSS score of 6.5 classifies the vulnerability as Medium severity. The lack of listing in the CISA KEV catalog suggests limited real‑world exploitation; the primary risk is to data integrity and availability for sites that rely on this plugin without additional access controls.