Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager <= 0.0.11 - Unauthenticated Sensitive Information Exposure via Banner Settings
- ID
- WPSEC-2026-0051
- Plugin
- Cookiez – GDPR & CCPA Cookie Banner & Consent Manager (cookiez)
- Affected
- all versions before 0.0.12
- Remediation
- Update to 0.0.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager (Cookiez) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.0.11. On sites connected to the Elementor service with the banner enabled, the front-end banner configuration (the cookiezBannerSettings JavaScript object printed on every public page) included the subscription ID and the entire stored plan data object returned by the Elementor service, which holds the email address and user ID of the connected Elementor account, the site and subscription IDs, the plan status and the quota usage. This makes it possible for unauthenticated attackers to obtain the site owner's Elementor account email address and subscription details by viewing the source of any front-end page.
References
- https://wpsec.com/vuln/WPSEC-2026-0051/
- https://plugins.svn.wordpress.org/cookiez/tags/0.0.12/
- https://wordpress.org/plugins/cookiez/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS