THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-13389 — The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPr

[NVD] CVE-2026-13389 — The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPr

mednvdPublished 2026-08-02

CVE-2026-13389 CVSS: None Published: 2026-08-02T06:16:34.550

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.

Indicators of compromise

CVE-2026-13389cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-13389