EUVD-2026-57094
GHSA-xcj8-382p-cc46
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
REST endpoint is network-accessible with low complexity; low privilege required (any authenticated user); impact is limited to partial integrity loss of a stored key with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
AnalysisAI
Incorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user - including low-privilege roles such as subscribers - to overwrite the plugin's stored geolocation service license key via a REST API route that fails its intended administrator-only capability check and falls back to a weaker authentication-only gate. The practical consequence is silent disruption of geolocation-based consent banner targeting, which can undermine GDPR and regional cookie-consent compliance workflows. Publicly available exploit code exists (no confirmed CISA KEV listing), and an EPSS score of 17% indicates above-average real-world exploitation interest relative to this severity class.
Technical ContextAI
The Cookie Consent WordPress plugin (CPE: cpe:2.3:a:unknown:cookie_consent:*:*:*:*:*:*:*:*) exposes a REST API route responsible for persisting the geolocation service license key it uses to determine visitor jurisdiction for consent banner targeting. CWE-863 (Incorrect Authorization) identifies the root cause: the authorization logic intended to enforce a WordPress administrator-level capability check on this route is incorrectly implemented and fails silently, causing the WordPress REST API framework to fall back to a weaker gate that requires only user authentication. In WordPress's role model, any registered account - subscriber, contributor, author, or editor - satisfies this fallback gate. The vulnerability is therefore not an authentication bypass (the user must be logged in) but a privilege escalation in authorization: a non-administrator is permitted to perform an action explicitly reserved for administrators, specifically writing the plugin's geolocation API credential into persistent storage.
RemediationAI
Update the Cookie Consent WordPress plugin to version 0.0.10 or later, which is confirmed as the vendor-released patch correcting the authorization logic on the geolocation license key REST route. Full advisory details are available from WPScan at https://wpscan.com/vulnerability/4f5ee68e-3513-4f05-839e-60ae62349f93/. After patching, administrators should audit the currently stored geolocation license key to verify it has not been tampered with by an unauthorized user. As a compensating control prior to patching, disabling open user registration reduces the pool of accounts that could exploit the endpoint, though this may affect site membership functionality. A WAF or web application firewall rule restricting POST requests to the affected REST route to administrator sessions only provides stronger interim protection but requires knowledge of the specific route path and may break legitimate plugin update flows if misconfigured.
More in Cookie Consent
View allBroken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a su
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today