Executive brief
The WebToffee Cookie Consent WordPress plugin, which manages visitor cookie preferences and GDPR compliance, contains multiple REST API endpoints that lack authorization checks. Unauthenticated attackers can exploit this to export or delete all stored visitor consent records, create unauthorized posts, and disable the plugin's license, exposing customer consent data and disrupting site administration.
Technical details
The vulnerability is a missing authorization control (CWE-862) affecting multiple REST API routes in the WebToffee Cookie Consent plugin versions before 3.5.3. The vulnerable endpoints (/wcc/v1/consent_logs/export, /wcc/v1/consent_logs/delete, /wcc/v1/policies/create, /wcc/v1/license/deactivate) are network-reachable and require no authentication, nonce, or user interaction. An unauthenticated attacker can send POST requests to these routes to export consent logs as CSV files, bulk-delete all consent records, create arbitrary draft pages, or deactivate the plugin license. The fix is available in version 3.5.3.
Affected products
- WebToffee Cookie Consent before 3.5.3
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Version 3.5.3 released