{"id":"CVE-2025-66080","aliases":["EUVD-2025-205816","GHSA-rfr5-8625-hm35"],"status":"published","title":"WordPress WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent plugin \u003c= 4.0.3 - Broken Access Control vulnerability","description":"Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through \u003c= 4.0.3.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00279,"percentile":0.2054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-12-30T16:10:40Z","modified":"2026-06-17T09:56:17Z","products":[{"vendor":"wp legal pages","product":"wp cookie notice for gdpr, ccpa \u0026 eprivacy consent"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-0-3-broken-access-control-vulnerability-2?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66080"},{"url":"https://vdp.patchstack.com/database/wordpress/plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-0-3-broken-access-control-vulnerability-2?_s_id=cve"},{"url":"https://patchstack.com/database/wordpress/plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-0-3-broken-access-control-vulnerability-2?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-rfr5-8625-hm35"}],"sources":{"cve":[{"id":"CVE-2025-66080","title":"WordPress WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent plugin \u003c= 4.0.3 - Broken Access Control vulnerability","description":"Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through \u003c= 4.0.3.","status":"published","published":"2025-12-30T16:10:40.664Z","modified":"2026-04-28T16:14:16.397Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-205816","description":"Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through \u003c= 4.0.3.","status":"published","published":"2025-12-30T16:10:40Z","modified":"2026-04-28T16:14:16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:31.69826Z"}],"ghsa":[{"id":"GHSA-rfr5-8625-hm35","title":"Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy...","description":"Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through 4.0.3.","status":"published","published":"2025-12-30T18:30:18Z","modified":"2026-01-20T15:32:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:05:45.590085Z"}],"nvd":[{"id":"CVE-2025-66080","description":"Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through \u003c= 4.0.3.","status":"published","published":"2025-12-30T16:15:46.077Z","modified":"2026-06-17T09:56:17.59Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:54.323368Z"}]}}