GDPR Cookie Consent CVE-2026-12955

Requires an authenticated WordPress session with at minimum Subscriber-level role - the vulnerability is only reachable via the wp_ajax_ AJAX hook, which enforces login. External exploitation therefore requires either open user registration on the target WordPress installation (allowing self-registration as a subscriber) or prior credential compromise. The specific vulnerable surface is the AJAX action wp_ajax_gcc_save_schedule_scan, which must be processed by a site where the GDPR Cookie Consent plugin is installed and active. Impact is bounded to writing attacker-controlled values to the gdpr_scan_schedule_data WordPress option; no code execution path exists through this vector alone. Sites with closed registration and no untrusted authenticated users face no external risk, though CSRF exploitation against an authenticated administrator is also possible due to the absent nonce, requiring social engineering to deliver a malicious link.

CVSS 3.1 scores this at 4.3 Medium with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting a low-privileges requirement and limited integrity impact with no confidentiality or availability consequences. The CVSS vector is internally consistent with the described behavior: the AJAX endpoint is network-accessible, exploitation is straightforward (AC:L), and a subscriber account suffices (PR:L). Real-world risk is constrained by two factors: first, the attacker must hold a valid WordPress account on the target site, meaning sites with open user registration are exposed while closed-registration sites are protected from external threats; second, the impact ceiling is administrative nuisance - corrupting cookie scan scheduling - rather than code execution, data theft, or site takeover. No EPSS data was provided and no CISA KEV listing exists, consistent with a low-priority finding. The 'Authentication Bypass' tag in the source intelligence is misleading; this is a missing authorization (privilege escalation of function) issue, not a bypass of the authentication layer itself. Overall, this is a genuine but low-severity finding whose CVSS score accurately reflects its limited blast radius.

An attacker who has registered a free subscriber account on a WordPress site running GDPR Cookie Consent 4.3.6 or earlier sends a crafted POST request to /wp-admin/admin-ajax.php with action=gcc_save_schedule_scan and manipulated schedule parameters. Because the handler performs no capability check and no nonce validation, the request is accepted and the gdpr_scan_schedule_data option is overwritten with attacker-controlled values, disrupting or disabling the site's scheduled cookie compliance scans. No public exploit code has been identified at time of analysis.