CVE-2026-4019: Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{postid}/{blockid} using returntrue as the permissioncallback, allowing any unauthenticated user to access it. The cmplzrestconsentedcontent() function retrieves a post by ID via getpost() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers to read the consent area block content from private, draft, or unpublished posts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4019?
CVE-2026-4019 is considered a high severity vulnerability due to the potential for unauthorized access to private post content.
How do I fix CVE-2026-4019?
To fix CVE-2026-4019, update the Complianz – GDPR/CCPA Cookie Consent plugin to version 7.4.6 or later.
What type of data is exposed in CVE-2026-4019?
CVE-2026-4019 exposes unauthorized access to private post content through the Consent Area REST endpoint.
Who is affected by CVE-2026-4019?
CVE-2026-4019 affects all users of the Complianz – GDPR/CCPA Cookie Consent plugin on WordPress versions up to and including 7.4.5.
Is authentication required to exploit CVE-2026-4019?
No, CVE-2026-4019 can be exploited without authentication, allowing unauthorized users to access sensitive content.