What is the CVSS score of CVE-2026-12955?

CVE-2026-12955 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

GDPR Cookie Consent CVE-2026-12955

EUVD-2026-42849 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 Wordfence

GHSA-mpv5-gg5q-pvgg

WordPress Authentication Bypass Wplegalpages Wordpress Plugin Cookie Banner For Gdpr Ccpa Wplp Cookie Consent

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible AJAX endpoint requires subscriber-level login (PR:L); impact is limited to partial integrity loss on one option with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:28 vuln.today

CVE Published

Jul 10, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the gdpr_cookie_consent_ajax_save_schedule_scan() function (the wp_ajax_gcc_save_schedule_scan AJAX action) in versions up to, and including, 4.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's cookie scan schedule configuration stored in the gdpr_scan_schedule_data option, which is an administrative function intended to be limited to users with the manage_options capability.

AnalysisAI

Unauthorized modification of cookie scan schedule configuration in the GDPR Cookie Consent WordPress plugin (versions up to 4.3.6) is achievable by any authenticated subscriber-level user. The vulnerability stems from a dual failure - absent capability check and absent nonce verification - on the wp_ajax_gcc_save_schedule_scan AJAX action, allowing low-privileged users to overwrite the gdpr_scan_schedule_data option that is administratively intended to require manage_options capability. No public exploit has been identified and the flaw is not listed in CISA KEV; a patched version (4.3.7) is available via the plugin's SVN repository.

Technical ContextAI

The affected plugin, identified in CPE as cpe:2.3:a:wplegalpages:cookie_banner_for_gdpr_/_ccpa_-_wplp_cookie_consent:*:*:*:*:*:*:*:* (marketed as Cookie Banner for GDPR/CCPA - WPLP Cookie Consent by WP Legal Pages), registers a WordPress AJAX action using the wp_ajax_ hook prefix, which restricts calls to logged-in users but applies no further authorization check. The root cause is CWE-862 (Missing Authorization): the function gdpr_cookie_consent_ajax_save_schedule_scan() at admin/class-gdpr-cookie-consent-admin.php lines 8132-8139 neither verifies that the calling user holds the manage_options capability nor validates a security nonce, the standard WordPress CSRF countermeasure. As a result, any subscriber with a valid WordPress session can submit a crafted AJAX POST to manipulate the plugin's scheduled cookie-scan timing stored in the gdpr_scan_schedule_data WordPress option. The nonce absence independently exposes administrators to CSRF if tricked into clicking a malicious link, though the wp_ajax_ prefix still enforces login.

RemediationAI

Update the GDPR Cookie Consent plugin to version 4.3.7 or later. The fix is documented in SVN changeset 3601475 at https://plugins.trac.wordpress.org/changeset/3601475/gdpr-cookie-consent/tags/4.3.7/admin/class-gdpr-cookie-consent-admin.php, which addresses the missing capability check and nonce verification in the affected AJAX handler. Note that version 4.3.7 as the patched release is inferred from the changeset tag path rather than a formal vendor release announcement - verify the changelog in the WordPress plugin directory before deploying. If immediate patching is not feasible, disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate external subscriber account creation, which removes the primary external attack path; this does not protect against insider threats from existing subscriber accounts. Alternatively, a WAF rule blocking POST requests to admin-ajax.php with action=gcc_save_schedule_scan for non-administrator sessions would mitigate the flaw without plugin changes, though this adds operational complexity and may interfere with legitimate admin workflows if misconfigured.