Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2023-6700 EUVD-2023-58921GHSA-gj6f-cjc7-f9fg

Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update

Published Feb 5, 2024 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: cookieinformation Product: Cookie Information | Free GDPR Consent Solution Category: Web / CMS

Description

The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create administrator accounts.

Affected products

VendorProductAffectedFixed
cookieinformation Cookie Information | Free GDPR Consent Solution ≤ 2.0.22 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • RandomRobbieBF/CVE-2023-6700 ★ 2 · Jan 30, 2024

    Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References