Complianz – GDPR/CCPA Cookie Consent: A security weakness

Complianz – GDPR/CCPA Cookie Consent is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 7.4.5.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Complianz – GDPR/CCPA Cookie Consent
Plugin slug: complianz-gdpr
Affected: <= 7.4.5
Safe version: > 7.4.5
Published: Apr 29, 2026
Weakness: CWE-862 — Missing Authorization

This CVE was published Apr 29, 2026 and is one of 6 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Complianz – GDPR/CCPA Cookie Consent to a release after 7.4.5, or disable and remove it until a fixed version is available.

Source record

Technical description

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated user to access it. The cmplz_rest_consented_content() function retrieves a post by ID via get_post() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers to read the consent area block content from private, draft, or unpublished posts.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Patch or disable the affected component.

Technical description

Primary and upstream sources