This vulnerability in the GDPR Framework plugin (versions before 2.4.0) allows any unauthenticated visitor to forge cookie consent records, impersonate data subjects, and submit fake privacy requests. The core issue: the plugin accepts consent submissions without any identity verification, creating records that claim a user consented when they never did.
The security failure is straightforward — missing authorization checks on consent processing endpoints — but the operational implications extend well beyond typical vulnerabilities. This plugin doesn't just process data; it generates the documentation an organization uses to prove regulatory compliance. When that documentation can be forged, it becomes a liability rather than a defense. A regulator asking "can you prove this consent was obtained?" now receives an answer that includes a published CVE describing exactly how those records can be falsified. The plugin's output has inverted its purpose: it now produces evidence that can be used against the organization in audits or legal proceedings.
Check your installed version immediately. If you're running anything before 2.4.0, treat this as a high-priority update regardless of the 6.5 CVSS score — the metric underweights the fact that your compliance documentation infrastructure is compromised. After updating, audit existing consent logs for suspicious entries: look for consent records created in bulk, from IP addresses you don't recognize, or with timestamps that don't correspond to actual site traffic.
The longer-term concern is persistence. Compliance plugins that appear to "work" rarely get updated once deployed, and this one will remain embedded in thousands of sites as a dependency for their legal posture. If you maintain any systems using this plugin, verify the version in production — don't assume it's current just because it's been running without errors.