CVE-2026-85132 is a missing authorization vulnerability (CWE-862) in the WPLP Cookie Consent WordPress plugin prior to version 4.4.2. The flaw arises because the plugin fails to verify nonce or user capabilities on a cookie scanner AJAX action. This allows any authenticated user, regardless of privilege level, to access the administrator's automated scan schedule information.

An attacker with any authenticated user account, including low-privilege roles like subscriber, can retrieve sensitive configuration information about the automated cookie scan schedule set by the administrator. While this does not directly allow code execution or privilege escalation, it exposes internal configuration details that could aid further attacks or reconnaissance.

No official patch or remediation guidance is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and monitor for unusual access patterns to AJAX endpoints related to cookie scanning.