CVE-2026-16613Disclosure

LOWCVSS 4.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/d9511e8a-be67-4c39-b947-7931b5569ffb/

Weakness type (CWE)

CWE-352

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Abdullah Kareem@CyberKareem91d
Disclosure
New CVE-2026-16613. GDPR Cookie Compliance < 5.1.0 (WordPress) The cookie-expiry action was reachable without authentication and did no request-origin check. One crafted link logs a visitor out and clears the site's cookies. #cve #research #appsec https://t.co/X4FUE5fyzA
Post summary
The post announces CVE‑2026‑16613 against the GDPR Cookie Compliance plugin, explains how the vulnerability allows unauthenticated cookie clearance via a crafted link, but gives no indication of active exploitation or remediation.
0000091
240 followersView on X

Explore more

Back to dashboard