Description

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T06:16:25.393Z",
  "pubdate": "2026-08-26T06:16:25.393Z",
  "executiveSummary": "The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin contains a critical broken access control vulnerability affecting all versions prior to 3.7.1.\nThe flaw resides within a REST API route that lacks requisite authorization checks, enabling unauthenticated remote attackers to query the endpoint and retrieve sensitive information.\nExposed data includes connected service API secrets and administrative account details, which poses a severe security risk to the integrity of the affected WordPress installation.\nSuccessful exploitation allows unauthorized third parties to retrieve credentials without any form of authentication or special privileges.\nThis vulnerability essentially facilitates the unauthorized extraction of integration credentials and allows attackers to perform administrative actions, such as disconnecting the plugin's third-party services.\nThe impact is significant due to the nature of the leaked data, which could lead to further compromise of external services connected to the plugin, and the potential for service disruption.",
  "technicalDetails": "The vulnerability is classified as an Improper Authorization flaw, specifically residing within the REST API implementation of the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin.\nRoot cause: The plugin exposes a REST API endpoint designed to manage or retrieve account settings and integration data. The implementation of this endpoint fails to perform a permissions check to verify if the requester has the necessary administrative capabilities (such as 'manage_options') before serving requested data.\nAffected versions: All versions of the plugin prior to 3.7.1 are susceptible to this unauthorized access.\nExploitation flow: An unauthenticated attacker can send a GET request to the specific REST API endpoint responsible for returning stored account configuration. Because the plugin does not implement server-side validation or access control headers for this route, the WordPress REST API framework processes the request and returns the requested JSON payload containing the sensitive data.\nData Exposure: The response contains highly sensitive information, including API secrets or tokens used for third-party integrations and internal account identifiers. This information is returned in cleartext to the requester.\nPayload behavior and impact: Once an attacker obtains the API secret or account details, they can leverage this information to impersonate the legitimate owner of the integration or perform unauthorized management tasks. Specifically, the vulnerability allows the attacker to force the disconnection of the plugin's integration with external services. Furthermore, if the leaked API secrets provide broader access to external platforms beyond the scope of the plugin, the attacker may pivot to those third-party services to conduct additional malicious activities, escalating the impact of the initial data breach.\nNetwork exposure: This vulnerability is remotely exploitable over the network, as the REST API is accessible to any visitor capable of reaching the site's REST interface. No user interaction or elevated session context is required by the attacker to successfully execute the request, making this a low-complexity, high-impact attack vector."
}