CVE-2026-12955 describes a missing authorization vulnerability in the GDPR Cookie Consent plugin for WordPress (WPLP Cookie Consent) versions up to and including 4.3.6. The vulnerability exists in the gdpr_cookie_consent_ajax_save_schedule_scan() function, which handles the wp_ajax_gcc_save_schedule_scan AJAX action. Due to the absence of capability checks and nonce verification, authenticated users with low privileges (Subscriber-level and above) can modify the gdpr_scan_schedule_data option, an administrative setting intended to be managed only by users with the manage_options capability. This unauthorized modification could affect the plugin's cookie scan scheduling.

The vulnerability allows authenticated users with Subscriber-level access or higher to modify administrative configuration data related to the cookie scan schedule. While it does not disclose sensitive information or allow privilege escalation directly, it permits unauthorized changes to plugin settings, potentially disrupting cookie compliance operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized changes to the gdpr_scan_schedule_data option. Applying principle of least privilege to user roles may reduce risk.