blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-16984

MEDIUM 6.5 CVSS 3.1
Published
August 26, 2026
Last modified
August 26, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-284
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Description

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.

Affected products and versions

  • Unknown Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates — Before 3.7.1

References

  • wpscan.com https://wpscan.com/vulnerability/c1bf0335-c954-473b-af30-7f227f041790/
  • nvd.nist.gov Official NVD record