Vulnerability · Published Aug 5, 2026 · Assigned by WPScan
CVE-2026-16613GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF
Medium 4.3
In plain English
A medium-severity cross-site request forgery in GDPR Cookie Compliance from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | GDPR Cookie Compliance | 0 – before 5.1.0 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
References
- https://wpscan.com/vulnerability/d9511e8a-be67-4c39-b947-7931b5569ffb/ exploit, vdb-entry, technical-description