CVE-2024-8286 - GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF

Back Back to CVE browser

MEDIUM

GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF

Published May 15, 2025

6.5

MEDIUM

CVSS 3.1

EPSS 0.20%

Description

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks

Affected products

Vendor n/a Product Webtoffee-Gdpr-Cookie-Consent Default
unaffected
Affected
- ≥ 0, < 2.6.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Webtoffee-Gdpr-Cookie-Consent	unaffected	Affected ≥ 0, < 2.6.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15265
Advisory
https://wpscan.com/vulnerability/628bbac0-76b1-4666-9c00-bae84b48f85c/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15265		Advisory
https://wpscan.com/vulnerability/628bbac0-76b1-4666-9c00-bae84b48f85c/		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published May 15, 2025

Updated May 17, 2025

Reserved Aug 28, 2024

Link CVE-2024-8286

CISA Vulnrichment

Updated May 17, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-8286

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published May 15, 2025

Updated May 17, 2025

Link EUVD-2025-15265

GitHub

No data