CVE-2026-16613: GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF
Published Aug 5, 2026
·Updated
The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.
Affected Software
1 affected component
WordPress plugin "GDPR Cookie Compliance"<5.1.0
Event History
Aug 5, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-16613?
CVE-2026-16613 has a risk rating of 28.
2
How do I fix CVE-2026-16613?
To fix CVE-2026-16613, update the GDPR Cookie Compliance plugin to version 5.1.0 or later.
3
What type of attack is associated with CVE-2026-16613?
CVE-2026-16613 is associated with Cross-Site Request Forgery (CSRF) attacks.
4
What can an attacker do with CVE-2026-16613?
An attacker can log users out and delete site cookies by tricking them into clicking a crafted link.
5
What versions of the GDPR Cookie Compliance plugin are affected by CVE-2026-16613?
Versions of the GDPR Cookie Compliance plugin prior to 5.1.0 are affected by CVE-2026-16613.