Complianz – GDPR/CCPA Cookie Consent Security & Risk Analysis

The Complianz GDPR plugin version 7.4.5 exhibits a mixed security posture. While it demonstrates good practices like utilizing prepared statements for a majority of its SQL queries (77%) and performing output escaping on a significant portion of outputs (78%), several areas raise concern. The presence of 13 unprotected entry points, including 5 AJAX handlers and 8 REST API routes lacking permission callbacks, represents a substantial attack surface that could be exploited by unauthenticated users.

Static analysis revealed the use of dangerous functions like 'unserialize', which can be a vector for remote code execution if user-supplied data is involved. Although the taint analysis did not uncover any critical or high severity issues with unsanitized paths, the existence of 4 flows with unsanitized paths warrants careful review to ensure no vulnerabilities were missed. The plugin's vulnerability history, with 9 known CVEs including one high severity and eight medium severity, points to recurring issues, particularly with Cross-Site Request Forgery (CSRF), Cross-site Scripting (XSS), and SQL Injection. The most recent vulnerability being in 2026 suggests potential for new vulnerabilities to emerge in the future, especially given the past patterns.

Overall, while the plugin has made strides in secure coding practices, the significant number of unprotected entry points and the historical pattern of common web vulnerabilities necessitate vigilance. The strengths lie in its efforts towards secure SQL handling and output escaping. However, the weaknesses in protecting critical entry points and the recurring nature of certain vulnerability types mean that users should ensure the plugin is always updated to the latest patched version to mitigate existing risks.