My Agile Privacy Cmp Cookie Consent Privacy Tools
Monthly
Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.
Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.