WordPress Plugin Vulnerabilities

WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

Description

The plugin does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.

Proof of Concept

Affects Plugins

Plugin icon
gdpr-cookie-consent
Fixed in 4.4.2

References

CVE
CVE-2026-85132

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
412f604b-ee33-42b6-8a39-00f7564d4e2b

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2025-01-16
Title
Cache Sniper for Nginx <= 1.0.4.2 - Missing Authorization
Published
2022-01-28
Title
Perfect Brands for WooCommerce < 2.0.5 - Subscriber+ Arbitrary Brand Creation
Published
2025-12-11
Title
Premmerce Brands for WooCommerce < 1.2.14 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update
Published
2022-11-11
Title
Add Multiple Marker <= 1.3 - Unauthenticated Settings Update
Published
2025-05-07
Title
LocateAndFilter < 1.6.17 - Missing Authorization