CyberRota Analysis
AI-GeneratedThe GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized data modification due to inadequate capability checks and nonce verification in the gdpr_cookie_consent_ajax_save_schedule_scan() function. This flaw allows authenticated attackers with Subscriber-level access or higher to alter the cookie scan schedule configuration, compromising the integrity of administrative settings. WordPress site administrators using this plugin should prioritize applying the latest updates to mitigate this risk.
Original NVD Description
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the gdpr_cookie_consent_ajax_save_schedule_scan() function (the wp_ajax_gcc_save_schedule_scan AJAX action) in versions up to, and including, 4.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's cookie scan schedule configuration stored in the gdpr_scan_schedule_data option, which is an administrative function intended to be limited to users with the manage_options capability.