CVE-2024-1592: Complianz GDPR Cookie Consent CSRF Vulnerability

CVE-2024-1592 Overview

CVE-2024-1592 is a Cross-Site Request Forgery (CSRF) vulnerability in the Complianz – GDPR/CCPA Cookie Consent plugin for WordPress. The flaw affects all versions up to and including 6.5.6. The vulnerability originates in the process_delete function within class-DNSMPD.php, which lacks proper nonce validation. Unauthenticated attackers can delete stored GDPR data requests by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352 and impacts installations that rely on the plugin to manage user consent records and data subject requests.

Critical Impact
Successful exploitation allows unauthenticated attackers to delete GDPR data subject requests, disrupting regulatory compliance workflows and destroying auditable consent records.

Affected Products

Really Simple Plugins Complianz – GDPR/CCPA Cookie Consent (WordPress plugin)
All versions from initial release up to and including 6.5.6
WordPress sites where a site administrator can be induced to load attacker-controlled content

Discovery Timeline

2024-03-02 - CVE-2024-1592 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1592

Vulnerability Analysis

The Complianz plugin exposes a process_delete handler in class-DNSMPD.php used to remove stored Data Subject Management Plugin Data (DNSMPD) records. These records represent GDPR and CCPA data requests submitted through the site. The handler does not verify a WordPress nonce and does not enforce a valid CSRF token before executing the delete operation.

Because the check is missing, any authenticated administrator session that loads an attacker-supplied URL or HTML resource will submit the delete request with full authority. The attacker never needs credentials on the target site. The impact is limited to integrity of stored records, as no data is exfiltrated and site availability is not directly affected. However, destruction of consent and data-request logs can create measurable regulatory exposure for site operators.

Root Cause

The root cause is missing or incorrect nonce validation on the process_delete function in class-DNSMPD.php. WordPress provides wp_verify_nonce() and check_admin_referer() primitives specifically for state-changing actions. The vulnerable handler either omits these checks or applies them incorrectly, so it accepts forged requests originating cross-site.

Attack Vector

Exploitation follows a standard CSRF pattern. An attacker hosts a page containing an auto-submitting form or image tag targeting the vulnerable endpoint on the victim WordPress site. The attacker delivers the URL through phishing, forum posts, or comments. When a logged-in administrator visits the resource, the browser attaches the WordPress session cookies and issues the delete request. The plugin executes the deletion because no nonce is validated.

No verified public proof-of-concept exists at the time of writing. Refer to the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2024-1592

Indicators of Compromise

Unexplained deletion of GDPR or CCPA data request records inside the Complianz plugin dashboard
HTTP POST requests to WordPress admin endpoints referencing the process_delete action originating from external Referer headers
Administrator sessions issuing plugin state-changes shortly after visiting untrusted external links
Web server access logs showing plugin admin actions without a preceding legitimate navigation from wp-admin

Detection Strategies

Inspect web server and WordPress audit logs for delete actions handled by class-DNSMPD.php that lack an in-domain Referer
Compare snapshots of DNSMPD tables against backups to detect unexpected record removal
Alert on administrator accounts triggering plugin write actions from browsers with recent third-party navigation history

Monitoring Recommendations

Enable a WordPress activity logging plugin to record plugin-level delete operations with actor, timestamp, and source IP
Forward web server and WordPress logs to a centralized SIEM for correlation of cross-site referrers with admin-only endpoints
Track the installed Complianz plugin version across the estate and flag any host still running 6.5.6 or earlier

How to Mitigate CVE-2024-1592

Immediate Actions Required

Upgrade the Complianz – GDPR/CCPA Cookie Consent plugin to a version later than 6.5.6 on every WordPress site in scope
Audit stored GDPR and CCPA data request records for unexpected deletions and restore from backup where required
Require administrators to log out of wp-admin sessions before browsing untrusted content and enforce short session lifetimes

Patch Information

The vendor addressed the missing nonce check in the plugin repository. Review the fix in the WordPress plugin changeset and update to the patched release published after changeset 3041903.

Workarounds

Restrict access to /wp-admin/ by source IP using web server or WAF rules until the plugin is updated
Deploy a WAF rule that blocks requests to the vulnerable admin action when the HTTP Referer header is missing or off-domain
Temporarily deactivate the Complianz plugin on sites that cannot be patched immediately and maintain data-request records through an alternative process

bash

# Example nginx snippet: block off-site POSTs to wp-admin action endpoints
location ~ ^/wp-admin/admin-(ajax|post)\.php$ {
    if ($request_method = POST) {
        if ($http_referer !~* "^https?://your-site\.example/") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-upstream;
}