CVE-2026-13389

{
  "etk_id": "ETK-2026-1952",
  "cve_id": "CVE-2026-13389",
  "display_id": "CVE-2026-13389",
  "ghsa_id": "GHSA-xw6w-vrqp-fhq4",
  "euvd_id": "EUVD-2026-51952",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing REST API authorization in webtoffee-cookie-consent",
  "summary": "webtoffee-cookie-consent versions before 3.5.3 expose REST API functions without adequate access control. An unauthenticated remote attacker may read or delete stored consent records, create WordPress posts, or change the plugin licensing state when an affected plugin is reachable.",
  "mitigation": "Update webtoffee-cookie-consent to version 3.5.3 or later. Until the update is complete, restrict unauthenticated access to the affected REST API routes where feasible.",
  "vendor": null,
  "product": "webtoffee-cookie-consent",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.5.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.5.3"
      ],
      "package_name": "webtoffee-cookie-consent",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 6.5,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss_score": 0.003,
  "epss_percentile": 0.2125,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 32.6845549,
  "t0_at": "2026-08-02T06:00:13.865000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T09:00:45.112863+00:00",
      "days": 77.12536166508102,
      "is_lower_bound": false,
      "measured_at": "2026-08-02T06:00:13.865000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 72,
      "is_lower_bound": false,
      "measured_at": "2026-08-02T06:00:13.865000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-13389"
    },
    "public_poc": {
      "at": "2026-08-02T06:00:13.865000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-08-02T06:00:13.865000+00:00",
      "url": "https://wpscan.com/vulnerability/a591c79d-5db7-4716-8b6c-004b1195edf7/"
    },
    "trigger_signal": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 71.74983952546296,
      "is_lower_bound": false,
      "measured_at": "2026-08-02T06:00:13.865000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-13389"
    }
  }
}