CVE-2026-18046: CWE-863 Incorrect Authorization in Cookie Consent
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
AI Analysis
Technical Summary
The Cookie Consent WordPress plugin before version 0.0.10 contains an incorrect authorization flaw (CWE-863) in a REST API route responsible for storing the geolocation service license key. The route is intended to restrict access to administrators only but falls back to an authentication-only check. As a result, any authenticated user can overwrite the license key, potentially disrupting the plugin's geolocation-based consent banner functionality. This affects version 0.0.9 of the plugin.
Potential Impact
Any authenticated user, including subscribers, can overwrite the geolocation service license key used by the plugin. This can disrupt the geolocation-based consent banner targeting, potentially affecting compliance with cookie consent regulations or user experience. There is no indication of privilege escalation beyond this or direct data exposure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only or disable the plugin if feasible to prevent unauthorized license key modification.
CVE-2026-18046: CWE-863 Incorrect Authorization in Cookie Consent
Description
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
CVSS v3.1
Score 4.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Cookie Consent WordPress plugin before version 0.0.10 contains an incorrect authorization flaw (CWE-863) in a REST API route responsible for storing the geolocation service license key. The route is intended to restrict access to administrators only but falls back to an authentication-only check. As a result, any authenticated user can overwrite the license key, potentially disrupting the plugin's geolocation-based consent banner functionality. This affects version 0.0.9 of the plugin.
Potential Impact
Any authenticated user, including subscribers, can overwrite the geolocation service license key used by the plugin. This can disrupt the geolocation-based consent banner targeting, potentially affecting compliance with cookie consent regulations or user experience. There is no indication of privilege escalation beyond this or direct data exposure.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only or disable the plugin if feasible to prevent unauthorized license key modification.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-28T09:51:25.146Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7c0ea3bf8831d53914350b
Added to database: 08/12/2026, 06:11:47 UTC
Last enriched: 08/12/2026, 06:32:22 UTC
Last updated: 08/13/2026, 00:41:10 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.