WordPress WP GDPR Cookie Consent 插件 <= 1.0.0 - 跨站请求伪造 (CSRF) 漏洞

攻击者可以利用此 CSRF 漏洞，通过伪造用户请求来执行恶意操作，例如在受害者不知情的情况下将恶意脚本存储到网站中。一旦脚本存储成功，任何访问该页面的用户都可能受到攻击，导致 XSS 攻击。攻击者可以利用 XSS 漏洞窃取用户 Cookie、重定向用户到恶意网站或篡改网站内容，从而造成严重的安全威胁。此漏洞的潜在影响包括用户数据泄露、账户接管以及网站声誉受损。

Websites using the WP GDPR Cookie Consent plugin, particularly those running older versions (1.0.0 and earlier), are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a vulnerability in one site could potentially impact others. Sites relying on the plugin for GDPR compliance are especially vulnerable, as a successful attack could compromise user data and violate privacy regulations.

• wordpress / composer / npm:

grep -r "wp_gdpr_cookie_consent" /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=all | grep wp-gdpr-cookie-consent

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-content/plugins/wp-gdpr-cookie-consent/ | grep -i '1.0.0'

1. 2025-11-06Disclosure

   disclosure

1. 已保留2025-06-27
2. 发布日期2025-11-06
3. 修改日期2026-04-28
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即将 WP GDPR Cookie Consent 插件升级到 1.0.1 版本。如果无法立即升级，可以考虑使用 Web 应用防火墙 (WAF) 来过滤恶意请求，并实施严格的输入验证和输出编码策略。此外，建议定期审查插件配置，确保 Cookie 设置具有适当的安全标志，例如 HttpOnly 和 Secure 标志，以减少 CSRF 攻击的风险。升级后，请检查网站日志，确认漏洞已成功修复。