Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Privacy Policy Generator plugin leaks API secret

CVE-2026-16984 · published 2 months ago
Summary

The WordPress plugin that creates privacy policies, terms and cookie notices (versions before 3.7.1) lets anyone on the internet request a special URL and see the service’s API key and account details. This information can be used to disconnect the plugin from its service. Update the plugin to version 3.7.1 or later, or remove it if you cannot update, to stop the exposure.

What to do
  • Update unknown privacy policy generator, terms & conditions, gdpr, ccpa, cookie policy & disclaimer templates to version 3.7.1 or later.
Affected software
VendorProductAffected versions
unknown privacy policy generator, terms & conditions, gdpr, ccpa, cookie policy & disclaimer templates < 3.7.1
Original advisory text
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that return...
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published26 Aug 2026
Updated4 Nov 2026
First seen26 Aug 2026
Sources
CVE-2026-16984 · NVD
CVE-2026-16984 · MITRE
Track software like this
Free during beta