CVE-2026-4019: Complianz Plugin Information Disclosure

CVE-2026-4019 Overview

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress contains an unauthorized data access vulnerability affecting all versions up to and including 7.4.5. This REST API vulnerability allows unauthenticated attackers to access content from private, draft, or unpublished posts through the /wp-json/complianz/v1/consent-area/{post_id}/{block_id} endpoint due to improper permission validation.

Critical Impact

Unauthenticated attackers can read sensitive consent area block content from private, draft, or unpublished WordPress posts, potentially exposing confidential information before it's intended for public release.

Affected Products

• Complianz – GDPR/CCPA Cookie Consent plugin for WordPress versions up to and including 7.4.5

Discovery Timeline

• 2026-04-29 - CVE-2026-4019 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-4019

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization). The core issue lies in the REST API endpoint registration where the permission_callback parameter is set to __return_true, a WordPress function that always returns true without performing any actual authorization checks.

The vulnerable function cmplz_rest_consented_content() retrieves posts by ID using WordPress's get_post() function and returns the consentedContent attribute from any complianz/consent-area block found within the post. The critical flaw is that this function does not verify:

• Whether the requesting user has permission to access the post
• Whether the post is published or in a protected state (draft, private, pending review)

This allows any unauthenticated user to enumerate post IDs and extract consent area block content from posts that should not be publicly accessible.

Root Cause

The root cause is the use of __return_true as the permission_callback in the REST API route registration. This effectively bypasses WordPress's built-in permission system, making the endpoint accessible to anyone without authentication. The subsequent get_post() call retrieves content regardless of post status or visibility settings, compounding the authorization failure.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by making direct HTTP requests to the REST API endpoint:

The vulnerable endpoint follows the pattern /wp-json/complianz/v1/consent-area/{post_id}/{block_id}. An attacker can enumerate post IDs by iterating through numeric values and checking for valid responses. When a post exists and contains a complianz/consent-area block, the API returns the consentedContent attribute regardless of the post's publication status. This allows extraction of content from draft posts (unpublished content), private posts (restricted visibility), scheduled posts (future publication), and password-protected posts. For technical implementation details, see the WordPress Plugin File and GitHub Code Reference.

Detection Methods for CVE-2026-4019

Indicators of Compromise

• Unusual volume of requests to /wp-json/complianz/v1/consent-area/ endpoints
• Sequential or enumerated post ID patterns in REST API requests
• Requests to consent-area endpoints from unauthenticated sources accessing draft or private post IDs
• HTTP 200 responses for consent-area requests that should return authorization errors

Detection Strategies

• Monitor web server access logs for repeated requests to the Complianz REST API endpoint with varying post IDs
• Implement Web Application Firewall (WAF) rules to detect and alert on enumeration attempts against the consent-area endpoint
• Review WordPress REST API audit logs for unauthenticated access patterns to Complianz endpoints

Monitoring Recommendations

• Configure alerting for high-frequency requests to /wp-json/complianz/v1/consent-area/ paths
• Monitor for successful responses to REST API requests from IP addresses without associated authenticated sessions
• Implement rate limiting on REST API endpoints to slow enumeration attempts

How to Mitigate CVE-2026-4019

Immediate Actions Required

• Update the Complianz – GDPR/CCPA Cookie Consent plugin to version 7.4.6 or later immediately
• Review access logs for potential prior exploitation of the vulnerable endpoint
• Audit any sensitive content stored in draft or private posts with consent-area blocks for potential exposure

Patch Information

The vulnerability has been patched in Complianz version 7.4.6. The fix implements proper authorization checks in the REST API endpoint's permission_callback to verify user permissions before returning post content. For details on the code changes, see the WordPress Changeset and the Version Comparison. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• If immediate patching is not possible, temporarily disable the Complianz plugin until the update can be applied
• Implement WAF rules to block unauthenticated requests to /wp-json/complianz/v1/consent-area/ endpoints
• Restrict REST API access at the server level using IP allowlisting for administrative functions

# Nginx configuration to block unauthenticated access to vulnerable endpoint
location ~* /wp-json/complianz/v1/consent-area/ {
    # Block requests without valid WordPress authentication cookie
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
    try_files $uri $uri/ /index.php?$args;
}