Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Privilege Escalation via 'cn_network' Parameter
- ID
- WPSEC-2026-0179
- Plugin
- Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA (cookie-notice)
- Affected
- from 2.4.0 before 3.1.10
- Remediation
- Update to 3.1.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
- Weakness
- CWE-269
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Cookie Notice & Compliance for GDPR / CCPA on WPSec AttackSurface
- Fix released
- Published
Description
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Privilege Escalation via the 'cn_network' parameter in versions 2.4.0 up to, and including, 3.1.9. On multisite installations the plugin treated any admin-ajax request carrying cn_network=1 as a Network Admin request, while the handlers that act on it only checked the site-level manage_options capability. This makes it possible for authenticated attackers with administrator-level access to a single subsite to write the network-wide plugin settings, including enabling the global settings override, replacing the Cookie Compliance app ID and key, and setting the custom consent scripts. Where the plugin is network-activated, every site on the network then serves that configuration, pointing all sites at an account the attacker controls and loading attacker-supplied scripts on every site.
References
- https://wpsec.com/vuln/WPSEC-2026-0179/
- https://plugins.svn.wordpress.org/cookie-notice/tags/3.1.10/
- https://wordpress.org/plugins/cookie-notice/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS