Is CVE-2026-13389 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13389 being exploited in the wild.

How severe is CVE-2026-13389?

Medium severity, with a CVSS score of 6.5, published 2 August 2026.

Which products and versions are affected?

WebToffee Cookie Consent before 3.5.3.

Is there a fix for CVE-2026-13389?

A patch was published on 2026-07-23: Version 3.5.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13389 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-13389?

Check whether you run WebToffee Cookie Consent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13389: WebToffee Cookie Consent authorization bypass in REST API

CVE-2026-13389 · Severity: medium · CVSS 6.5 · Published 2026-08-02

The WebToffee Cookie Consent WordPress plugin, which manages visitor cookie preferences and GDPR compliance, contains multiple REST API endpoints that lack authorization checks. Unauthenticated attackers can exploit this to export or delete all stored visitor consent records, create unauthorized posts, and disable the plugin's license, exposing customer consent data and disrupting site administration.

Technologies: WebToffee Cookie Consent. Vendors: WebToffee.

Quick answers

Is CVE-2026-13389 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13389 being exploited in the wild.
How severe is CVE-2026-13389?: Medium severity, with a CVSS score of 6.5, published 2 August 2026.
Which products and versions are affected?: WebToffee Cookie Consent before 3.5.3.
Is there a fix for CVE-2026-13389?: A patch was published on 2026-07-23: Version 3.5.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13389 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-13389?: Check whether you run WebToffee Cookie Consent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization control (CWE-862) affecting multiple REST API routes in the WebToffee Cookie Consent plugin versions before 3.5.3. The vulnerable endpoints (/wcc/v1/consent_logs/export, /wcc/v1/consent_logs/delete, /wcc/v1/policies/create, /wcc/v1/license/deactivate) are network-reachable and require no authentication, nonce, or user interaction. An unauthenticated attacker can send POST requests to these routes to export consent logs as CSV files, bulk-delete all consent records, create arbitrary draft pages, or deactivate the plugin license. The fix is available in version 3.5.3.

Affected products

WebToffee Cookie Consent before 3.5.3

Timeline

2026-07-23: disclosed
2026-07-23: patched: Version 3.5.3 released

References

https://wpscan.com/vulnerability/a591c79d-5db7-4716-8b6c-004b1195edf7/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.