Unauthorized Data Modification in GDPR Cookie Consent Plugin for WordPress

CVE-2026-12955

What is CVE-2026-12955?

The GDPR Cookie Consent plugin for WordPress contains a security flaw where the gdpr_cookie_consent_ajax_save_schedule_scan() function lacks proper capability checks and nonce verification. This vulnerability allows authenticated users with Subscriber-level access and above to inadvertently or maliciously alter the cookie scan schedule configuration, impacting the integrity of sensitive administrative functions. This issue affects all versions up to and including 4.3.6, enabling unauthorized modifications that should be restricted to users with appropriate administrative privileges.

References