CVE-2026-13389
WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.
| Vendor | unknown |
| Product | webtoffee-cookie-consent |
| Published | Aug 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown webtoffee-cookie-consent
Be the first to know when new unknown vulnerabilities affecting unknown webtoffee-cookie-consent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / webtoffee-cookie-consent
0 < 3.5.3
References
Credits
Eran Kapeluto WPScan