CyberRota Analysis
AI-GeneratedThe Cookie Consent WordPress plugin prior to version 0.0.10 has a vulnerability that allows any authenticated user, including those with minimal permissions like subscribers, to modify consent settings and access stored visitor consent logs on sites using the vendor's paid plan. This misconfiguration poses a risk of unauthorized data exposure and manipulation of consent settings. WordPress site administrators, especially those using the affected plugin, should prioritize updating to the latest version to mitigate potential security risks.
Original NVD Description
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.