CVE-2023-4013
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 lacks proper CSRF checks when managing its license, which could allow attackers to force logged in admins to update and deactivate the plugin's license via CSRF attacks.
Risk Assessment
The lack of proper CSRF protections may lead to unauthorized changes in the plugin's configuration by attackers, threatening system integrity and potentially violating data protection regulations.
Recommendation
It is recommended to update the plugin to version 4.12.5 or later to mitigate the security vulnerability and implement additional protections against CSRF attacks.
Original NVD description (English source)
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks