CVE-2023-4013: 
WordPress vulnerability analysis and mitigation

The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before version 4.12.5 contains a Cross-Site Request Forgery (CSRF) vulnerability in its license management functionality. The vulnerability was discovered and disclosed on August 7, 2023, affecting all versions of the plugin prior to 4.12.5 (WPScan).

The vulnerability stems from improper CSRF protection mechanisms in the plugin's license management functionality. With a CVSS v3.1 base score of 6.5 (Medium), the vulnerability is characterized by the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (NVD).

If successfully exploited, this vulnerability could allow attackers to manipulate the plugin's license status by making logged-in administrators unknowingly perform license-related actions. Specifically, attackers could force administrators to update or deactivate the plugin's license through CSRF attacks (WPScan).

The vulnerability has been patched in version 4.12.5 of the GDPR Cookie Compliance plugin. Users are strongly advised to update to this version or later to protect against potential CSRF attacks (WPScan).