CVE-2026-18046
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key. The route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt geolocation-based consent banner targeting.
Risk Assessment
Unauthorized users can change the license key, potentially disrupting the plugin and affecting privacy compliance.
Recommendation
Update the Cookie Consent plugin to version 0.0.10 or later that includes the fix.
Original NVD description (English source)
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.