CVE-2026-13389

The issue concerns the webtoffee-cookie-consent WordPress plugin prior to version 3.5.3 . The vulnerability arises because several REST API routes do not perform authorization checks, enabling unauthenticated attackers to export and delete stored visitor consent records, create posts, and alter t...