CVE-2024-3599: The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in al

medium Affects gdpr-cookie-consent (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2024-05-02; advisory modified 2026-06-17.

The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in al

Package: gdpr-cookie-consent (WordPress plugin) WordPress
Affected versions: <3.1.0
Fixed in: 3.1.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 1% (44.5th percentile)
Published: 2024-05-02
Source: nvd

References

CWE-862

NVD record gdpr-cookie-consent (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2020-20633 medium ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator same package: gdpr-cookie-consent (WordPress plugin)
CVE-2024-4869 high The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to same package: gdpr-cookie-consent (WordPress plugin)
CVE-2024-11724 medium The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (f same package: gdpr-cookie-consent (WordPress plugin)
CVE-2024-8397 medium The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not properly sanitize same package: gdpr-cookie-consent (WordPress plugin)
CVE-2024-8286 medium The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks same package: gdpr-cookie-consent (WordPress plugin)
CVE-2022-1329 high The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution same weakness: CWE-862