The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/628bbac0-76b1-4666-9c00-bae84b48f85c/ | Exploit Third Party Advisory |
Configurations
History
12 Jun 2025, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:webtoffee:gdpr_cookie_consent:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/628bbac0-76b1-4666-9c00-bae84b48f85c/ - Exploit, Third Party Advisory | |
| CWE | CWE-352 | |
| First Time |
Webtoffee gdpr Cookie Consent
Webtoffee |
15 May 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-15 20:15
Updated : 2025-06-12 15:34
NVD link : CVE-2024-8286
Mitre link : CVE-2024-8286
JSON object : View
Products Affected
webtoffee
- gdpr_cookie_consent
CWE
CWE-352
Cross-Site Request Forgery (CSRF)