CVE-2026-12955 describes a missing authorization vulnerability in the GDPR Cookie Consent plugin for WordPress (WPLP Cookie Consent). The function gdpr_cookie_consent_ajax_save_schedule_scan(), which handles the AJAX action wp_ajax_gcc_save_schedule_scan, lacks proper capability checks and nonce verification. This allows authenticated users with low privileges (Subscriber-level and above) to modify the gdpr_scan_schedule_data option, which controls the plugin's cookie scan schedule. This administrative function should be restricted to users with the manage_options capability, but the vulnerability permits unauthorized modification.

An attacker with authenticated access at Subscriber level or higher can modify the plugin's cookie scan schedule configuration, an administrative setting. This could lead to unauthorized changes in how cookie scanning is scheduled, potentially impacting compliance or plugin behavior. There is no direct impact on confidentiality or availability reported, only integrity of this configuration is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users and monitor plugin updates closely. Avoid granting Subscriber-level or higher access to untrusted users. No official patch or workaround is currently documented.