Skip to content
Sign in
5.4 Medium

CVE-2024-5607 The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data…

Description

The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings() in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings, update page content, send arbitrary emails and inject malicious web scripts.

Affected products and versions

Product Affected versions Fixed in
GDPR CCPA Compliance & Cookie Consent Banner 2.7 earliest → 2.7.0 No fix stated

Other CVEs of GDPR CCPA Compliance & Cookie Consent Banner

The 2 CVEs of GDPR CCPA Compliance & Cookie Consent Banner →
CVE-2020-36718 The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and… 9.8 Critical
Track this CVE