What is GHSA-xw6w-vrqp-fhq4?

GHSA-xw6w-vrqp-fhq4 is a security advisory published by GitHub Security Advisories with Medium severity. The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks...

Which CVE IDs does GHSA-xw6w-vrqp-fhq4 cover?

GHSA-xw6w-vrqp-fhq4 covers the following CVE IDs: CVE-2026-13389. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xw6w-vrqp-fhq4?

GHSA-xw6w-vrqp-fhq4 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-xw6w-vrqp-fhq4MediumCVSS 6.5

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks...

Vendor

GitHub Security Advisories

Published

August 2, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-13389 →

📋 Description

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13389
https://wpscan.com/vulnerability/a591c79d-5db7-4716-8b6c-004b1195edf7
https://github.com/advisories/GHSA-xw6w-vrqp-fhq4