This vulnerability (CVE-2024-11724) affects all versions up to and including 3.6.5 of the wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin. It is caused by a missing capability check on the wpl_script_save AJAX action, which permits authenticated users with low privileges (Subscriber-level and above) to whitelist scripts without proper authorization. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and the requirement for authenticated access. The vulnerability is classified under CWE-862 (Missing Authorization). No patch or official fix information is currently available.

The vulnerability allows unauthorized modification of the script whitelist by authenticated users with Subscriber-level access or higher. This could lead to integrity issues where unauthorized scripts are allowed to run, potentially undermining the intended cookie consent controls. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious changes to script whitelists. Avoid granting unnecessary privileges to low-level authenticated users. Follow updates from the vendor or WordPress plugin repository for patches or official mitigation instructions.