medium6.5
CVE-2026-13389
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated at…
Impact
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.
Affected products
| Product | Affected versions |
|---|---|
| Webtoffee-Cookie-Consent WordPress Plugin | before 3.5.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.