A missing authorization flaw in the WordPress GDPR Cookie Consent plugin exposes sensitive site configuration and API credentials to unauthenticated attackers.

This vulnerability is a missing authorization flaw (CWE-862) located in the gdpr/v1/settings REST API endpoint. It permits unauthenticated attackers to remotely access sensitive plugin settings, including API tokens, email addresses, and site keys.

Successful exploitation of this vulnerability allows unauthorized access to critical site configuration data. Given the CVSS score of 7.5, this high severity vulnerability could lead to the compromise of external account integrations, potential data exfiltration, and further unauthorized actions if the exposed API tokens are leveraged against third party services.

Immediate Action: Update the GDPR Cookie Consent plugin to the latest available version that includes the patch for this authorization vulnerability.

Proactive Monitoring: Review web server access logs for anomalous GET requests directed at the /wp-json/gdpr/v1/settings endpoint, particularly from unauthorized or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the vulnerable REST API path until the plugin update can be applied.

Public Exploit Available: No

This vulnerability presents a significant risk to site security due to the exposure of sensitive API keys and configuration data. Administrators must prioritize updating this plugin immediately to close the unauthorized access vector and prevent potential downstream compromise of integrated services.