Unauthorized Data Modification Vulnerability in Cookiebot CMP by Usercentrics
CVE-2025-1666
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 March 2025
What is CVE-2025-1666?
The Cookiebot CMP plugin for WordPress, developed by Usercentrics, is susceptible to unauthorized data modifications due to a lack of capability checks in the send_uninstall_survey() function. This vulnerability affects all versions up to and including 4.4.1. As a result, authenticated attackers with Subscriber-level access and higher can manipulate survey submissions on behalf of a website, potentially compromising data integrity and user trust.
Affected Version(s)
Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics * <= 4.4.1