Complianz GDPR/CCPA Cookie Consent Missing Authorization Vulnerability in WordPress REST API Endpoint

A vulnerability exists in the Complianz – GDPR/CCPA Cookie Consent plugin for WordPress, affecting all versions up to and including 7.4.5. The issue arises from a REST API endpoint that allows unauthorized access to private, draft, or unpublished post content. This is due to the endpoint's permission callback being set to always return true, enabling any unauthenticated user to access sensitive information.

Impact

Exploitation of this vulnerability allows unauthorized users to access and read content from private, draft, or unpublished posts, specifically targeting the consent area blocks within those posts.

Remediation

Users are advised to update the Complianz – GDPR/CCPA Cookie Consent plugin to version 7.4.6 or a newer patched version.