The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress contains a REST API endpoint that lacks proper authorization checks. The function cmplz_rest_consented_content() retrieves post content without verifying that the post is published or that the requester has permission. This flaw permits any user, even unauthenticated, to read the consent area block from private, draft, or unpublished posts, exposing potentially sensitive information. The weakness maps to CWE‑862, Missing Authorization.

This vulnerability affects all installations of the Complianz plugin version 7.4.5 and earlier. The plugin is distributed by the vendor Complianz and is installed as a WordPress add‑on. Users should verify that their version is 7.4.6 or newer to avoid exposure.

The CVSS score of 5.3 denotes moderate severity, and the EPSS score is not available, indicating insufficient data on exploit likelihood. The flaw is not listed in CISA’s KEV catalog. It can be exploited by sending a simple HTTP GET request to /wp-json/complianz/v1/consent-area/{post_id}/{block_id}. Because the endpoint returns data without authentication, an attacker can collect content from any post, regardless of its visibility status, without local or network privileges.