CVE-2026-16984: WordPress Privacy Policy Plugin Auth Bypass

CVE-2026-16984 Overview

CVE-2026-16984 is a missing authorization vulnerability [CWE-284] in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1. The plugin exposes a REST API route that returns stored account data without verifying the caller's identity. Unauthenticated visitors can retrieve the connected service's API secret and account details. Attackers can then use these credentials to disconnect the plugin's integration with its upstream service.

Critical Impact
Unauthenticated remote attackers can retrieve API secrets and account details from vulnerable WordPress sites, then disrupt the plugin's third-party integration.

Affected Products

Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin
All versions prior to 3.7.1
WordPress installations that have activated and connected the plugin's integration

Discovery Timeline

2026-08-26 - CVE-2026-16984 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-16984

Vulnerability Analysis

The vulnerability resides in a REST API route registered by the plugin. The route returns stored account data, including the connected service's API secret. The endpoint lacks a permission_callback that validates the caller's capability or authentication state. As a result, any unauthenticated visitor can issue a request and receive sensitive integration credentials in the response.

Once an attacker obtains the API secret, they can call the upstream service directly. The most direct abuse path documented is disconnecting the plugin's integration, which disrupts the site's privacy policy generation workflow. Because the leak exposes credentials belonging to an external account, the impact can extend beyond the WordPress instance itself.

Root Cause

The root cause is a missing authorization check [CWE-284] on a WordPress REST route. WordPress REST endpoints registered through register_rest_route() require an explicit permission_callback to enforce access control. When developers set this callback to __return_true or omit it, the endpoint accepts anonymous requests. This plugin exposes account data through such an unprotected route.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends an HTTP request to the plugin's REST endpoint under /wp-json/. No authentication, user interaction, or elevated privileges are required. The response contains the API secret and account details in structured form, ready for reuse against the upstream service.

Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-16984

Indicators of Compromise

Unauthenticated HTTP GET requests to the plugin's REST namespace under /wp-json/ originating from unfamiliar IP addresses
Access log entries showing bulk enumeration of /wp-json/ routes across multiple WordPress hosts
Unexpected disconnection events for the plugin's upstream integration or forced re-authentication prompts in the WordPress admin

Detection Strategies

Review web server access logs for anonymous requests to the plugin's REST endpoints and correlate with response sizes that indicate account data disclosure
Alert on REST API responses containing fields such as api_secret, account_id, or similar credential markers returned to unauthenticated sessions
Compare installed plugin versions against 3.7.1 across all managed WordPress sites and flag installations below that threshold

Monitoring Recommendations

Enable WordPress access logging and forward logs to a centralized analytics platform for anomaly detection on /wp-json/ traffic
Monitor the upstream integration provider's audit log for API calls originating from unexpected source IPs
Track plugin update status across the WordPress fleet and generate alerts when vulnerable versions remain deployed

How to Mitigate CVE-2026-16984

Immediate Actions Required

Update the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates plugin to version 3.7.1 or later on every WordPress site
Rotate the API secret for the connected upstream service, since prior disclosure cannot be ruled out
Review the upstream service's audit log for unauthorized disconnection or configuration changes

Patch Information

The vendor addressed the issue in version 3.7.1 of the plugin by adding an authorization check to the affected REST route. Site administrators should install this release through the WordPress plugin manager or by deploying the updated package. Refer to the WPScan Vulnerability Report for the confirmed fixed version.

Workarounds

Deactivate and remove the plugin until the update to version 3.7.1 can be applied
Restrict access to /wp-json/ at the web server or web application firewall layer, allowing only authenticated administrative sources
Revoke and reissue the API secret held by the plugin's upstream service to invalidate any previously disclosed credentials

bash

# Example nginx rule restricting WordPress REST API to authenticated sessions
location ~ ^/wp-json/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
    try_files $uri $uri/ /index.php?$args;
}