Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Sensitive Information Exposure via Data Request REST Endpoint

ID

WPSEC-2026-0884

Plugin

Complianz GDPR/CCPA Cookie Consent Banner (complianz-gdpr)

Affected

all versions before 7.5.6

Remediation

Update to 7.5.6 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-204

Usage

Plugin High · Affected versions High among sites WPSec scans, 2026-10-14

Attack surface

Complianz GDPR/CCPA Cookie Consent Banner on WPSec AttackSurface

Fix released

2026-10-13

Published

2026-10-14

Description

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Sensitive Information Exposure via the public data request REST endpoint in all versions up to, and including, 7.5.5 due to the endpoint returning a distinct response when a request is already in progress for a given email address, and lacking any rate limiting. This makes it possible for unauthenticated attackers to determine whether a specific person has submitted a data subject request, and to repeatedly trigger confirmation and notification emails to arbitrary addresses and the site administrator.

References

• https://wpsec.com/vuln/WPSEC-2026-0884/
• https://plugins.svn.wordpress.org/complianz-gdpr/tags/7.5.6/
• https://wordpress.org/plugins/complianz-gdpr/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS