Cookie Notice & Compliance for GDPR / CCPA <= 3.1.9 - Authenticated (Administrator+) Missing Authorization to Network-Wide Settings Modification
- ID
- WPSEC-2026-0180
- Plugin
- Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA (cookie-notice)
- Affected
- from 2.4.0 before 3.1.10
- Remediation
- Update to 3.1.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Cookie Notice & Compliance for GDPR / CCPA on WPSec AttackSurface
- Fix released
- Published
Description
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to unauthorized modification of data in versions 2.4.0 up to, and including, 3.1.9 because several network-scoped write paths only checked the site-level manage_options capability. This makes it possible for authenticated attackers with administrator-level access on a multisite network to change settings shared by every site: a main-site administrator who is not a Super Admin could open and save the network settings screen (including the Cookie Compliance app ID and key and the global override), and, where the plugin is network-activated with global settings override, subsite administrators could edit the network-wide autoblocking catalogue, change the shared Cookie Compliance app configuration (privacy laws, design, languages, plans), and disable the WP Consent API integration for every site on the network.
References
- https://wpsec.com/vuln/WPSEC-2026-0180/
- https://plugins.svn.wordpress.org/cookie-notice/tags/3.1.10/
- https://wordpress.org/plugins/cookie-notice/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS