CVE-2019-25143 GDPR Cookie Compliance <= 4.0.2 - Missing Authorization

What is CVE-2019-25143?

CVE-2019-25143 is a medium-severity missing authorization vulnerability in mooveagency GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law, published on 7 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings.

Weakness: CWE-862

Which versions are affected by CVE-2019-25143?

It affects 1 product.

Products include Mooveagency Gdpr Cookie Compliance.

How do I fix CVE-2019-25143?

No fix has been published for CVE-2019-25143 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-25143 being exploited?

There is no known exploitation of CVE-2019-25143 in the wild and no public exploit code.

Other vulnerabilities in mooveagency GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law

• CVE-2023-4013 GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRF Medium 6.5
• CVE-2025-1619 GDPR Cookie Compliance < 4.15.7 - Admin+ Stored XSS Medium 4.8
• CVE-2025-1620 GDPR Cookie Compliance < 4.15.7 - Admin+ Stored XSS Medium 4.8
• CVE-2025-1621 GDPR Cookie Compliance < 4.15.7 - Admin+ Stored XSS Medium 4.8
• CVE-2025-2205 GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mq3m-4v9p-w3jq.