EUVD-2026-57084
GHSA-m52v-mw7v-c5gf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L reflects required subscriber authentication; I:L is added over the official vector because modifying consent settings constitutes a tangible integrity impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
AnalysisAI
Broken authorization in the Cookie Consent WordPress plugin before 0.0.10 allows any authenticated user - including a subscriber - to invoke administrator-intended REST API endpoints that control consent settings. Affected sites on the vendor's paid plan face an additional confidentiality exposure: the same misconfigured routes permit low-privileged users to read stored visitor consent logs, data that may carry GDPR compliance significance. A publicly available exploit exists, and an EPSS of 18% signals meaningful near-term exploitation probability despite the moderate CVSS score.
Technical ContextAI
The affected component is the Cookie Consent WordPress plugin (CPE: cpe:2.3:a:unknown:cookie_consent:*:*:*:*:*:*:*:*), all releases prior to 0.0.10. WordPress plugins enforce access control through a capability system; this plugin registers REST API routes for consent-settings management and intends to restrict them to administrators. CWE-863 (Incorrect Authorization) is the root cause: the administrator-level capability check is improperly implemented or short-circuited, causing WordPress to fall back to an authentication-only gate. Any logged-in user with at minimum subscriber role can therefore reach these routes. The secondary impact - reading visitor consent logs - is conditional on the site being enrolled in the vendor's paid plan, indicating a cloud-linked storage component for consent records, which widens the data-exposure surface beyond local plugin settings.
RemediationAI
Update the Cookie Consent WordPress plugin to version 0.0.10 or later, which contains the vendor-released patch correcting the capability enforcement on the consent-settings REST routes; the WPScan advisory at https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1/ confirms the fix version. If immediate patching is not feasible, disable WordPress user registration to eliminate the subscriber-level attack surface - note this will prevent new account creation and may break membership flows. As an additional control for paid-plan sites concerned about consent-log exposure, audit and remove non-essential authenticated accounts until the patch is applied, keeping in mind this may disrupt legitimate contributor or editor workflows. Sites under GDPR obligations should assess whether unauthorized access to consent logs constitutes a reportable incident under applicable data protection law.
More in Cookie Consent
View allIncorrect authorization in the Cookie Consent WordPress plugin (versions before 0.0.10) allows any authenticated user -
A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Conse
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today