Description

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T06:18:09.547Z",
  "pubdate": "2026-08-12T06:18:09.547Z",
  "executiveSummary": "An improper authorization vulnerability has been identified in the Cookie Consent WordPress plugin affecting versions prior to 0.0.10. The flaw stems from an incorrect capability check implementation within the plugin's consent-settings REST API routes. Rather than enforcing strict administrator-only access controls, the affected endpoints improperly fall back to an authentication-only access gate.\nThis security deficiency permits any authenticated user, including low-privileged accounts such as subscribers, to interact with sensitive administrative endpoints. Consequently, malicious actors or compromised low-privilege accounts can manipulate plugin configuration parameters by updating the consent settings. Furthermore, on installations actively connected to the vendor's paid plan, unauthorized users can leverage these exposed routes to read stored visitor consent logs, potentially leading to unauthorized data exposure.\nThe risk implications include unauthorized configuration tampering and potential leakage of sensitive compliance-related logs. Exploitation requires the attacker to possess valid low-privilege authentication credentials on the target WordPress instance, allowing them to issue crafted HTTP requests directly to the vulnerable REST API endpoints without requiring administrative privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in flawed access control logic within the Cookie Consent WordPress plugin prior to version 0.0.10. Specifically, the consent-settings REST routes fail to explicitly and correctly validate that the incoming request originates from a user possessing administrative capabilities, such as manage_options.\nBecause the capability checks are improperly structured or omitted, the WordPress REST API framework defaults to falling back to an authentication-only gate. As a result, the security boundary is reduced from checking specific administrative roles to merely verifying whether the requesting entity possesses a valid authentication session or cookie, regardless of their assigned user role.\nThe attack flow proceeds as follows: an authenticated attacker with low privileges, such as a subscriber account, crafts an HTTP request targeting the vulnerable consent-settings REST API routes. The request bypasses the intended administrative restriction because the endpoint evaluates only authentication status rather than the required capability level. Upon successful processing of the request, the attacker is able to execute unauthorized operations. These include modifying the plugin's consent settings to alter user-facing behavior, or, in environments linked to the vendor's paid plan, extracting sensitive stored visitor consent logs.\nThe vulnerable components are the REST API route handlers responsible for managing consent settings within the Cookie Consent WordPress plugin. The affected software versions comprise all releases preceding version 0.0.10. Network exposure is present via the HTTP/HTTPS interface exposed by the WordPress REST API endpoints. Privilege requirements are limited to standard, low-level user authentication, removing the necessity for administrative compromise to achieve initial unauthorized access to these functions."
}