CVE-2019-25143: GDPR Cookie Compliance <= 4.0.2 - Missing Authorization
The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdprcookiecomplianceresetsettings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of the WordPress GDPR Cookie Compliance plugin vulnerability?
The vulnerability ID is CVE-2019-25143.
What is the severity of CVE-2019-25143?
The severity of CVE-2019-25143 is medium, with a CVSS score of 4.3.
How does the vulnerability in the GDPR Cookie Compliance plugin allow for authorization bypass?
The vulnerability allows authenticated attackers to reset all of the settings in the plugin due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action.
Which versions of the GDPR Cookie Compliance plugin are affected by CVE-2019-25143?
Versions up to and including 4.0.2 of the GDPR Cookie Compliance plugin for WordPress are affected by the vulnerability.
Are there any references available for CVE-2019-25143?
Yes, you can find references for CVE-2019-25143 at the following links: [link1](https://blog.nintechnet.com/wordpress-gdpr-cookie-compliance-plugin-fixed-authenticated-settings-deletion-vulnerability/), [link2](https://wpscan.com/vulnerability/5ac51325-a7f5-4d38-9b41-61855206083d), [link3](https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-gdpr-cookie-compliance-security-bypass-4-0-2/)