CVE-2026-14816

MediumCVSS 6.5

Published: 04/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The GDPR Framework By Data443 WordPress plugin before version 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests. This allows unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

Risk Assessment

An attacker can manipulate consent records, violating GDPR compliance, and flood the privacy request queue, potentially leading to operational and legal issues.

Recommendation

Update the plugin to version 2.4.0 or later. Implement additional identity verification mechanisms and restrict access to consent recording functions.

Other vulnerabilities in GDPR Framework By Data443

CVE-2026-39797Critical
Unauthenticated PHP Object Injection vulnerability in GDPR Framework By Data443 versions up to 2.5.0. An attacker can inject malicious PHP objects, potentially leading to code execution.

Original NVD description (English source)

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS