Security Alert Summary
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress contains a REST API endpoint that allows unauthenticated access to consent-area block content. An unauthenticated user can retrieve consent area content from posts without checks for publication status or read permissions, which can expose content stored in private, draft, or unpublished posts.
CVE Details
- CVE ID: CVE-2026-4019
- Affected component: Complianz – GDPR/CCPA Cookie Consent plugin (REST API endpoint)
- Affected versions: All versions up to, and including, 7.4.5
- Published: April 29, 2026 at 9:16:25 AM UTC
- Last modified: April 29, 2026 at 9:16:25 AM UTC
- CVSS v3.1: Base Score 5.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- Weakness (CWE): CWE-862 (Missing Authorization)
Technical Details
The vulnerability originates from the REST API route /wp-json/complianz/v1/consent-area/{post_id}/{block_id} being registered with a permission_callback that returns true (specifically using __return_true). As a result, the endpoint is callable by unauthenticated requests.
The endpoint handler, the cmplz_rest_consented_content() function, retrieves a post by ID using get_post() and extracts the consentedContent attribute from any complianz/consent-area block it finds. The function does not verify that the post is published nor whether the requesting user has permission to read the post. Because of these missing authorization checks, an unauthenticated attacker can read consent-area block content from private, draft, or otherwise unpublished posts.
Impact is limited to the exposed content within the consent-area block (confidentiality impact). This does not, based on the provided data, indicate code execution, integrity modification, or availability disruption.
How This Could Impact Your Website
Consider a typical small organization that uses WordPress for internal and public pages. The site owner may store internal contact lists, draft announcements, or contractor notes inside pages that include Complianz consent-area blocks. An unauthenticated attacker could fetch the consent-area content from those private or draft posts and access internal email addresses or notes that were intended to remain private.
Practical consequences include exposure of internal user email addresses or sensitive text snippets stored in consent-area blocks, which increases the risk of targeted phishing or social engineering against staff, contractors, or contributors. The issue affects only the consent-area block content returned by the endpoint; it does not imply direct administrative takeover or site-wide compromise based on the information given.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts with write access to posts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual requests to REST API endpoints, particularly requests to
/wp-json/complianz/v1/consent-area/.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/complianz/complianz-gdpr/blob/64c09657bd028f62d7b50a54d83ca19b87df2cef/rest-api/rest-api.php#L61
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.4.4.2/rest-api/rest-api.php#L54
- https://plugins.trac.wordpress.org/browser/complianz-gdpr/tags/7.4.4.2/rest-api/rest-api.php#L61
- https://plugins.trac.wordpress.org/changeset/3508713/complianz-gdpr/trunk/rest-api/rest-api.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fcomplianz-gdpr/tags/7.4.5&new_path=%2Fcomplianz-gdpr/tags/7.4.6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3892489e-6ff7-4664-bb06-b8edff6dd659?source=cve
