7.5
High
CVE-2025-11754 The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability…
Description
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to retrieve sensitive plugin settings including API tokens, email addresses, account IDs, and site keys.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cookie Banner for GDPR / CCPA – WPLP Cookie Consent 4.1 | earliest → 4.1.2 | No fix stated |
Other CVEs of Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
The 9 CVEs of Cookie Banner for GDPR / CCPA – WPLP Cookie Consent →
CVE-2026-12955
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
4.3
Medium
CVE-2026-14475
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection…
4.9
Medium
CVE-2026-12920
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection…
4.9
Medium
CVE-2025-14061
The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie…
5.3
Medium