CVE-2026-16613: GDPR Cookie Compliance CSRF Vulnerability

CVE-2026-16613 Overview

CVE-2026-16613 is a Cross-Site Request Forgery (CSRF) vulnerability in the GDPR Cookie Compliance WordPress plugin before version 5.1.0. The plugin exposes an unauthenticated action that expires visitor cookies without performing a request-origin check. An attacker can craft a malicious link that, when visited by an authenticated user, forces a logout and deletes the site's cookies. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Any authenticated WordPress user who follows a crafted link can be logged out, and site cookies can be destroyed, disrupting session state and site usability.

Affected Products

GDPR Cookie Compliance WordPress plugin versions prior to 5.1.0
WordPress sites with the affected plugin installed and active
Any authenticated visitors or administrators of vulnerable sites

Discovery Timeline

2026-08-05 - CVE-2026-16613 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16613

Vulnerability Analysis

The GDPR Cookie Compliance plugin registers an action reachable without authentication. This action expires the visitor's cookies but omits any verification that the request originated from the site itself. Because the endpoint accepts requests from any origin and lacks a WordPress nonce check, an attacker can trigger the cookie-expiration flow through a forged request. The result is forced logout and deletion of cookies for any visitor lured to an attacker-controlled page.

The defect targets availability rather than confidentiality or integrity. An attacker cannot read cookies or hijack sessions, but they can degrade the user experience and disrupt administrators mid-workflow. Repeated exploitation can effectively deny service to logged-in users.

Root Cause

The root cause is missing CSRF protection [CWE-352] on a state-changing endpoint. The plugin's cookie-expiration handler does not validate a WordPress nonce (wp_verify_nonce) or a Referer/Origin header before acting. Because the handler is exposed on an unauthenticated route, any browser session with an active WordPress cookie can be forced to invoke it by loading an attacker-controlled URL or resource.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page or embeds a resource that issues a request to the vulnerable endpoint on the target WordPress site. When a logged-in user loads the attacker's page, the browser automatically sends session cookies with the cross-origin request. The plugin processes the request, expires the user's cookies, and effectively logs them out. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-16613

Indicators of Compromise

Unexpected session terminations affecting multiple authenticated WordPress users within a short time window
Web server access logs showing requests to the plugin's cookie-expiration action with external Referer headers
User complaints about being logged out immediately after clicking external links or visiting third-party sites

Detection Strategies

Inventory WordPress installations for the GDPR Cookie Compliance plugin and flag versions earlier than 5.1.0
Inspect access logs for unauthenticated requests to the plugin's action endpoints paired with cross-origin Referer values
Correlate spikes in WordPress authentication events with prior HTTP requests to the affected plugin endpoint

Monitoring Recommendations

Alert on abnormal rates of session invalidations or re-authentication events on WordPress sites
Monitor Web Application Firewall (WAF) logs for requests to plugin endpoints lacking valid nonces
Track plugin version drift across managed WordPress fleets to identify unpatched instances

How to Mitigate CVE-2026-16613

Immediate Actions Required

Upgrade the GDPR Cookie Compliance plugin to version 5.1.0 or later on all WordPress sites
Audit installed plugins and remove any unmaintained or unused components that expose unauthenticated actions
Advise administrators and editors to avoid clicking untrusted links while authenticated to WordPress

Patch Information

The vendor addressed the issue in GDPR Cookie Compliance version 5.1.0 by adding a request-origin check on the cookie-expiration action. Refer to the WPScan Vulnerability Report for advisory details and version guidance.

Workarounds

Deactivate the GDPR Cookie Compliance plugin until it can be upgraded to 5.1.0 or later
Deploy WAF rules that block requests to the vulnerable action lacking a same-origin Referer or valid WordPress nonce
Restrict administrative access to WordPress from dedicated browser profiles that do not visit untrusted sites

bash

# Example WP-CLI commands to check and update the plugin
wp plugin get gdpr-cookie-compliance --field=version
wp plugin update gdpr-cookie-compliance --version=5.1.0