Authorization Bypass in Webtoffee Cookie Consent Plugin by Webtoffee
CVE-2026-13389
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 2 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13389?
The Webtoffee Cookie Consent plugin for WordPress, prior to version 3.5.3, is vulnerable due to the absence of proper authorization checks across several REST API routes. This weakness allows unauthenticated attackers to perform critical actions such as exporting and deleting stored visitor consent records, creating posts, and modifying the plugin's licensing state. It highlights the vital importance of implementing robust authorization mechanisms to protect sensitive operations within plugins.
Affected Version(s)
webtoffee-cookie-consent 0 < 3.5.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.