# Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Sensitive Information Exposure via Data Request REST Endpoint

- **ID:** WPSEC-2026-0884
- **Plugin:** Complianz GDPR/CCPA Cookie Consent Banner (`complianz-gdpr`), https://wordpress.org/plugins/complianz-gdpr/
- **Affected versions:** all versions before 7.5.6
- **Fixed in:** 7.5.6 (Update to 7.5.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-204
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/complianz-gdpr
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0884/

## Description

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Sensitive Information Exposure via the public data request REST endpoint in all versions up to, and including, 7.5.5 due to the endpoint returning a distinct response when a request is already in progress for a given email address, and lacking any rate limiting. This makes it possible for unauthenticated attackers to determine whether a specific person has submitted a data subject request, and to repeatedly trigger confirmation and notification emails to arbitrary addresses and the site administrator.

## References

- https://wpsec.com/vuln/WPSEC-2026-0884/
- https://plugins.svn.wordpress.org/complianz-gdpr/tags/7.5.6/
- https://wordpress.org/plugins/complianz-gdpr/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0884/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.