CVE-2026-13389 Overview
CVE-2026-13389 is a missing authorization vulnerability [CWE-862] in the WebToffee Cookie Consent WordPress plugin before version 3.5.3. The plugin fails to perform capability checks on several of its REST API routes. Unauthenticated attackers can invoke these endpoints over the network without any credentials. Successful exploitation allows attackers to export and delete stored visitor consent records, create posts, and modify the plugin's licensing state. The flaw affects confidentiality and integrity of stored consent data and site content managed through the plugin.
Critical Impact
Unauthenticated network attackers can exfiltrate and delete visitor consent records, create arbitrary posts, and tamper with plugin licensing state on affected WordPress sites.
Affected Products
- WebToffee Cookie Consent WordPress plugin versions before 3.5.3
- WordPress sites with the webtoffee-cookie-consent plugin installed and active
- Any deployment relying on the affected plugin for GDPR or ePrivacy consent management
Discovery Timeline
- 2026-08-02 - CVE-2026-13389 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-13389
Vulnerability Analysis
The vulnerability stems from missing authorization controls on multiple REST API routes registered by the WebToffee Cookie Consent plugin. When the plugin registers routes with the WordPress REST API, it does not attach a permission_callback that verifies the caller's capabilities. As a result, WordPress accepts unauthenticated requests to sensitive endpoints and executes their handlers without restriction.
Exposed operations include exporting stored consent records, deleting stored consent records, creating posts, and modifying the plugin's licensing state. Consent records may contain visitor identifiers and timestamps that support regulatory audit trails, so deletion or exfiltration undermines compliance and disclosure obligations. Post creation gives attackers a foothold to publish content, and licensing state changes may disable or downgrade paid functionality.
Root Cause
The root cause is a broken access control pattern classified under [CWE-862] Missing Authorization. REST route registrations in the plugin lack a permission_callback that returns a capability check such as current_user_can('manage_options'). WordPress treats any handler without an explicit permission callback as callable by anyone, so the endpoints are reachable without authentication.
Attack Vector
Exploitation requires only network access to the target site. An attacker sends crafted HTTP requests to the vulnerable REST routes under /wp-json/ exposed by the plugin. No user interaction and no prior authentication are required. See the WPScan Vulnerability Report for endpoint-level technical details.
Detection Methods for CVE-2026-13389
Indicators of Compromise
- Unauthenticated HTTP requests to REST routes under /wp-json/ namespaces owned by the webtoffee-cookie-consent plugin.
- Unexpected deletion or export of visitor consent records in the plugin's storage tables.
- New WordPress posts created without a corresponding authenticated author session.
- Changes to the plugin's license status, activation key, or licensing flags without administrator action.
Detection Strategies
- Review web server and WordPress logs for POST and DELETE requests to plugin REST endpoints originating from unauthenticated sessions.
- Correlate wp_posts inserts and consent record modifications with the source IP and authentication status of the initiating request.
- Alert on any REST API call to the plugin's routes that lacks a valid X-WP-Nonce header or authenticated cookie.
Monitoring Recommendations
- Enable WordPress request logging or a web application firewall to capture full REST API traffic to /wp-json/.
- Baseline normal administrative activity on the plugin and alert on deviations in consent record volume or licensing state.
- Monitor the plugin version in use and flag any site still running a version below 3.5.3.
How to Mitigate CVE-2026-13389
Immediate Actions Required
- Update the WebToffee Cookie Consent plugin to version 3.5.3 or later on all affected WordPress sites.
- Audit consent records, posts, and licensing state for evidence of unauthorized changes since the plugin was installed.
- Rotate any plugin license keys that may have been altered or exposed.
Patch Information
The vendor addressed CVE-2026-13389 in WebToffee Cookie Consent version 3.5.3 by adding proper authorization checks to the affected REST API routes. Administrators should upgrade through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for advisory references.
Workarounds
- If patching is not immediately possible, deactivate and remove the webtoffee-cookie-consent plugin until an upgrade can be completed.
- Block unauthenticated requests to the plugin's REST namespaces at a web application firewall or reverse proxy layer.
- Restrict /wp-json/ access to authenticated administrators via HTTP authentication or IP allowlisting on management interfaces.
# Example WP-CLI upgrade command
wp plugin update webtoffee-cookie-consent --version=3.5.3
wp plugin list --name=webtoffee-cookie-consent --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
