CVE-2026-16613CWE-352csrf

CVE-2026-16613

Medium · published August 5, 2026

CVSS v3.1

4.3

EPSS

Percentile

6.2

In the wild

Unconfirmed

What it is

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00171 · 6.2th percentile
Weakness: CWE-352 · Cross-Site Request Forgery (CSRF)
Published: 2026-08-05T11:16Z

References (1)

https://wpscan.com/vulnerability/d9511e8a-be67-4c39-b947-7931b5569ffb/ · [email protected]

EPSS history

Timeline

05 AUG 06:00Z
GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF
cvelistv5