CyberRota Analysis
AI-GeneratedThe webtoffee-cookie-consent plugin for WordPress versions prior to 3.5.3 lacks proper authorization checks on its REST API routes, enabling unauthenticated attackers to export and delete visitor consent records, as well as create posts and alter the plugin's licensing state. This vulnerability poses a risk to the integrity and confidentiality of user consent data. WordPress site administrators using this plugin should prioritize updating to version 3.5.3 or later to mitigate potential exploitation.
Original NVD Description
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.