WordPress Plugin Vulnerabilities

The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam

Description

The plugin does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

Proof of Concept

Affects Plugins

Plugin icon
gdpr-framework
Fixed in 2.4.0

References

CVE
CVE-2026-14816

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
72af92a2-afe6-4e5a-9a1a-6f6e97bbcd85

Timeline

Publicly Published
2026-07-27 (about 8 days ago)
Added
2026-07-27 (about 7 days ago)
Last Updated
2026-07-27 (about 7 days ago)

Other

Published
Title
Published
2021-09-30
Title
JS Job Manager < 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation
Published
2021-10-26
Title
Bulk Datetime Change < 1.12 - Missing Authorisation
Published
2021-07-12
Title
Advanced Menu Manager < 3.0.7 - Unauthorised Menu Creation/Deletion
Published
2025-02-18
Title
Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode
Published
2021-10-05
Title
JobSearch WP Job Board < 1.8.2 - Unauthenticated Plugin's Settings Update