What the vulnerability does
01Description
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the gdpr_cookie_consent_ajax_save_schedule_scan() function (the wp_ajax_gcc_save_schedule_scan AJAX action) in versions up to, and including, 4.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's cookie scan schedule configuration stored in the gdpr_scan_schedule_data option, which is an administrative function intended to be limited to users with the manage_options capability.
Explanation of Vulnerability in Simple Terms
02Summary
The Cookie Banner for GDPR / CCPA plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify cookie consent settings they should not have access to. The vulnerability affects versions up to 4.3.6. An attacker with a basic user account can alter cookie banner configuration without proper permission checks, potentially affecting site compliance and user consent tracking.
What an attacker can do
03Attacker Capabilities
Modify cookie consent settings and banner configuration without proper authorization.
Potential impact on your site
04Site Impact
Cookie consent settings could be altered by unauthorized users, breaking GDPR/CCPA compliance and consent tracking.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
July 10, 2026
CVE published
