CVE-2026-14816

This vulnerability in the GDPR Framework plugin (versions before 2.4.0) allows any unauthenticated visitor to forge cookie consent records, impersonate data subjects, and submit fake privacy requests. The core issue: the plugin accepts consent submissions without any identity verification, creating records that claim a user consented when they never did. The security failure is straightforward — missing authorization checks on consent processing endpoints — but the operational implications extend well beyond typical vulnerabilities. This plugin doesn't just process data; it generates the documentation an organization uses to prove regulatory compliance. When that documentation can be forged, it becomes a liability rather than a defense. A regulator asking "can you prove this consent was obtained?" now receives an answer that includes a published CVE describing exactly how those records can be falsified. The plugin's output has inverted its purpose: it now produces evidence that can be used against the organization in audits or legal proceedings. Check your installed version immediately. If you're running anything before 2.4.0, treat this as a high-priority update regardless of the 6.5 CVSS score — the metric underweights the fact that your compliance documentation infrastructure is compromised. After updating, audit existing consent logs for suspicious entries: look for consent records created in bulk, from IP addresses you don't recognize, or with timestamps that don't correspond to actual site traffic. The longer-term concern is persistence. Compliance plugins that appear to "work" rarely get updated once deployed, and this one will remain embedded in thousands of sites as a dependency for their legal posture. If you maintain any systems using this plugin, verify the version in production — don't assume it's current just because it's been running without errors.

Reviewed through automated stages and approved by a human before publication.