Unauthenticated REST API Access in WebToffee Cookie Consent Plugin

Executive Summary

The vulnerability in the webtoffee-cookie-consent WordPress plugin before version 3.5.3 allows unauthenticated attackers to perform unauthorized actions via REST API routes. These actions include exporting and deleting visitor consent records, creating posts, and modifying the plugin's licensing state without proper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to REST API routes in the webtoffee-cookie-consent plugin. Inspect logs for unusual POST, GET, or DELETE requests to endpoints like /wp-json/webtoffee/v1/export, /wp-json/webtoffee/v1/delete, or /wp-json/webtoffee/v1/create. Verify plugin version is 3.5.3 or higher.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, such as visitor consent records. Attackers could delete or export this data, create unauthorized posts on your site, or alter the plugin's licensing, potentially disrupting its functionality and compromising user trust.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with GDPR and other privacy regulations by allowing unauthorized access to or deletion of visitor consent records. GDPR requires proper handling of consent data, and unauthorized modifications or deletions could result in non-compliance and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update the webtoffee-cookie-consent plugin to version 3.5.3 or later immediately. Disable REST API routes if not required. Review logs for signs of exploitation and remove unauthorized posts or records. Implement strict access controls for WordPress admin and API endpoints.

Useful 0 Not Useful 0