{
 "id": "WPSEC-2026-0884",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0884/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0884/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0884/index.md",
 "title": "Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Sensitive Information Exposure via Data Request REST Endpoint",
 "description": "The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Sensitive Information Exposure via the public data request REST endpoint in all versions up to, and including, 7.5.5 due to the endpoint returning a distinct response when a request is already in progress for a given email address, and lacking any rate limiting. This makes it possible for unauthenticated attackers to determine whether a specific person has submitted a data subject request, and to repeatedly trigger confirmation and notification emails to arbitrary addresses and the site administrator.",
 "plugin": {
  "slug": "complianz-gdpr",
  "name": "Complianz GDPR/CCPA Cookie Consent Banner",
  "full_name": "Complianz GDPR/CCPA Cookie Consent Banner",
  "wordpress_org": "https://wordpress.org/plugins/complianz-gdpr/",
  "advisories_url": "https://wpsec.com/vuln/plugin/complianz-gdpr/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/complianz-gdpr"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-204"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.5.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.5.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.5.6",
 "remediation": "Update to 7.5.6 or later.",
 "fix_released": "2026-10-13T07:32:00+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:13:02.424005+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0884/",
  "https://plugins.svn.wordpress.org/complianz-gdpr/tags/7.5.6/",
  "https://wordpress.org/plugins/complianz-gdpr/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/complianz-gdpr",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-14"
 }
}