CVE-2026-13389: WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13389?
CVE-2026-13389 has a risk rating of 54, indicating it poses a moderate security threat.
How do I fix CVE-2026-13389?
To fix CVE-2026-13389, update the WebToffee Cookie Consent plugin to version 3.5.3 or later.
What kind of data can be compromised due to CVE-2026-13389?
CVE-2026-13389 allows unauthorized access to stored visitor consent records, enabling exposure to sensitive data.
What should I do if I cannot update to fix CVE-2026-13389?
If an update is not possible, consider disabling the WebToffee Cookie Consent plugin until a fix can be applied.
Who is affected by CVE-2026-13389?
Anyone using WebToffee Cookie Consent versions prior to 3.5.3 is at risk due to this vulnerability.