CVE-2023-6700 is a high severity (CVSS 8.8) missing authorization flaw in the Cookie Information Free GDPR Consent Solution plugin for WordPress, versions up to and including 2.0.22. Any logged-in user, even a subscriber, can edit site options. Update to a release newer than 2.0.22, or remove the plugin.
What's affected
The record lists the plugin wp-gdpr-compliance from Cookie Information for WordPress, versions up to and including 2.0.22. Authenticated attackers with subscriber-level access or higher can use the flaw. That matters on any site that allows open registration, membership signups or customer accounts.
The record points to a WordPress.org plugin changeset and a Wordfence entry. Neither page could be read when this post was written, so the exact fixed version is not confirmed here. Treat any release above 2.0.22 as the starting point and confirm the fixed number in the plugin changelog.
How to check if you're exposed
Run these from your WordPress root with WP-CLI. They only read.
wp plugin list --fields=name,status,version,update
wp plugin get wp-gdpr-compliance --field=version
Any version at or below 2.0.22 is in the affected range. If WP-CLI is not available, open Plugins in the dashboard and read the version under the plugin name. Also check staging copies, old backups restored to test sites, and multisite networks, where the plugin may be installed on only some sites.
What to do now
- Update the plugin:
wp plugin update wp-gdpr-compliance, or use the Plugins screen. Confirm the new version is above 2.0.22 and read the changelog. - If no fixed release is available, deactivate and delete the plugin and use a maintained alternative.
- Review the site's user list and recent changes for anything you do not recognize, and rotate credentials the plugin handled.
- Keep automatic updates on for plugins that handle sensitive data, and remove plugins you no longer use.
- Check Settings and Users for changes you did not make, especially new administrator accounts or changed default role or registration options.
Why it matters
The cause is a missing capability check on an AJAX request handler. The handler lets a caller update arbitrary site options. In WordPress, options control things like whether anyone can register and which role new users get, so the ability to write them is a short path to creating administrator accounts. The record says exactly that.
Missing authorization is one of the most common plugin flaws. A handler is wired to a web request, it does real work, and it never asks whether the person calling it is allowed to. Logging in is not the same as being permitted. Any account on the site, even the lowest role, can reach code that was written with administrators in mind.
Patch priority depends on who can reach the flaw. Issues open to anonymous visitors come first, then issues that need a low-privilege account, then issues that need an administrator. Use the access level in the description to place this item in your queue, and write down the date you updated so you can answer later when someone asks whether a given site was exposed.
Weakness class in the record: CWE-862 (Missing Authorization).
Quick check
Does a site need open registration to be at risk?
The attacker needs a logged-in account with subscriber access or higher. If your site never creates accounts for outsiders, the exposure is smaller, but any compromised low-privilege account becomes enough.
How do I find every site that runs this plugin?
Check your hosting dashboards and any site management tool, and run the WP-CLI commands above on each install. Agencies and hosts often forget staging copies and sites inherited from clients.
Sources
The Wordfence and WordPress.org pages did not load for automated reading, so the description comes from the NVD record.
Last reviewed: 19 October 2026.
