CVE-2025-66080 - WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability

Back Back to CVE browser

MEDIUM

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability

Published Dec 30, 2025

5.3

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.

Affected products

Vendor WP Legal Pages Product WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Default
unaffected
Affected
- ≤ 4.0.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
WP Legal Pages	WP Cookie Notice for GDPR, CCPA & ePrivacy Consent	unaffected	Affected ≤ 4.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-205816		Advisory
https://patchstack.com/database/Wordpress/Plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-0-3-broken-access-control-vulnerability-2?_s_id=cve		vdb-entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Patchstack

Published Dec 30, 2025

Updated Apr 28, 2026

Reserved Nov 21, 2025

Link CVE-2025-66080

CISA Vulnrichment

Updated Dec 30, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-66080

Red Hat

No data

ENISA EUVD

Assigner Patchstack

Published Dec 30, 2025

Updated Apr 28, 2026

Link EUVD-2025-205816

GitHub

No data