Description

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T06:19:22.783Z",
  "pubdate": "2026-08-12T06:19:22.783Z",
  "executiveSummary": "The Cookie Consent WordPress plugin before 0.0.10 suffers from an authorization enforcement vulnerability affecting its REST API implementation. Specifically, the vulnerability stems from the plugin's failure to properly enforce its intended administrator-only capability checks on the designated REST route responsible for storing the geolocation service license key.\nBecause of this missing capability validation, the affected REST route improperly falls back to a generic authentication-only access gate. Consequently, any authenticated user—regardless of low-privilege status, such as a standard subscriber account—can successfully interact with the endpoint.\nAn attacker possessing low-privileged authenticated access can exploit this flaw to overwrite the stored geolocation service license key. This unauthorized modification can directly disrupt the plugin's core geolocation-based consent banner targeting mechanisms, leading to potential compliance failures or functional degradation of the consent management features.\nThe risk implication is moderate to high depending on the site's user registration policies, as open registration sites allow arbitrary external actors to acquire subscriber accounts and immediately execute the attack. Exploitation requires network access to the WordPress REST API and valid low-privileged credentials.",
  "technicalDetails": "The vulnerability resides within the REST API routing and permission callback implementation of the Cookie Consent WordPress plugin in versions prior to 0.0.10. WordPress REST API endpoints typically require explicit permission callbacks that validate user capabilities (such as 'manage_options') to ensure that only authorized administrators can execute sensitive configuration updates.\nIn the vulnerable versions, the specific REST route used for handling and storing the geolocation service license key fails to execute the intended administrator-level capability check. Instead of validating that the requesting user possesses administrative privileges, the endpoint's access control logic erroneously falls back to a basic authentication check. This means the system only verifies that the HTTP request originates from a recognized, authenticated session, completely bypassing the necessary role-based access control (RBAC) checks.\nThe attack flow proceeds as follows: 1) An attacker registers or compromises a low-privileged account on the target WordPress site, such as a subscriber account. 2) The attacker crafts an HTTP POST or PUT request targeting the vulnerable REST route responsible for updating the geolocation service license key. 3) The attacker includes the session cookie or application password associated with the low-privileged subscriber account in the request headers, along with a malicious or arbitrary string representing the new license key in the request payload. 4) The WordPress REST API processes the request, passes the basic authentication gate because the user is logged in, and invokes the endpoint handler without verifying if the user has the 'manage_options' capability. 5) The plugin updates the database entry with the attacker-supplied license key.\nThe vulnerable component is the REST API endpoint handler within the Cookie Consent WordPress plugin prior to version 0.0.10. Network exposure is standard HTTP/HTTPS access to the WordPress REST API namespace. The payload behavior involves injecting manipulated configuration data directly into the plugin's storage mechanism. The post-exploitation impact includes the corruption of the geolocation service license key, resulting in the complete disruption of geolocation-based consent banner targeting, potentially exposing the site to regulatory non-compliance regarding regional privacy laws."
}