Security Alert Summary
The WP Cookie Consent plugin for WordPress contains a vulnerability that allows unauthenticated attackers to permanently delete arbitrary posts, pages, attachments, and other post types by ID. The issue is caused by a missing capability check in a delete function, affecting all versions up to and including 4.0.7.
CVE Details
- CVE ID: CVE-2025-14061
- Affected plugin / component: The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress
- Affected versions: All versions up to and including 4.0.7
- Published: December 17, 2025 at 7:15:58 AM UTC
- Last modified: December 17, 2025 at 7:15:58 AM UTC
- CVSS v3.1: Base Score 5.3, Severity MEDIUM, Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: No privileges required (PR:N), No user interaction required (UI:N), Network attack vector (AV:N)
- Primary impact: Integrity impact: LOW; Confidentiality: NONE; Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability exists because the plugin’s gdpr_delete_policy_data function lacks a capability check. Without that authorization check, unauthenticated actors can invoke the deletion behavior to permanently remove posts, pages, attachments, and other post types by specifying their IDs. The deletion is performed by the plugin code path associated with that function; the CVE description specifically names gdpr_delete_policy_data as the function missing the required permission validation.
This is an authorization bypass (CWE-862) rather than a flaw in WordPress core. The impact is limited to the ability to delete post-type content by ID through the affected function; it does not indicate additional privilege escalation beyond that delete action in the information provided.
How This Could Impact Your Website
In a typical small business WordPress site managed by an owner with multiple internal staff and occasional external contractors, the issue could play out like this:
- An unauthenticated attacker discovers an endpoint or action that triggers the plugin’s
gdpr_delete_policy_datafunction. - The attacker issues requests that reference IDs for pages, posts, or media attachments and those items are deleted permanently.
- The site owner and internal staff may lose published content or media assets, and external contributors could find their work removed without notice.
Practical consequences include the loss of published content, potential disruption to site operations, and the need to restore from backups if available. There is also an increased risk of targeted phishing or social engineering if attacker access to deleted-content metadata reveals information about editors or contributors. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and lower-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and logs for unusual deletion events or unexpected requests targeting plugin endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.0.6/admin/class-gdpr-cookie-consent-admin.php#L8091
- https://plugins.trac.wordpress.org/browser/gdpr-cookie-consent/tags/4.0.6/admin/class-gdpr-cookie-consent-admin.php#L8878
- https://www.wordfence.com/threat-intel/vulnerabilities/id/866b4ca8-563f-4a19-bbf7-79a79f07d53d?source=cve
