The Cookie Consent WordPress plugin prior to version 0.0.10 contains an authorization flaw (CWE-863) where the consent-settings REST routes do not properly restrict access to administrators. The routes fall back to an authentication-only check, enabling any authenticated user to modify consent settings. Furthermore, on paid plan sites, this flaw allows reading of visitor consent logs, potentially exposing sensitive user consent data.

Any authenticated user, including low-privileged roles such as subscribers, can modify the plugin's consent settings, which may affect site compliance with privacy regulations. On sites connected to the vendor's paid plan, these users can also access stored visitor consent logs, potentially exposing sensitive information about visitors' consent choices. This could lead to privacy violations or misuse of consent data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and monitor plugin updates closely. Avoid granting unnecessary authentication capabilities to low-privileged users. Follow vendor advisories for official fixes once released.