The WPLP Cookie Consent WordPress plugin prior to version 4.4.2 does not implement nonce or capability checks on multiple AJAX actions related to its settings. This missing authorization (CWE-862) enables any authenticated user to access and manipulate sensitive data belonging to administrators, including reading and destroying scan data and modifying the plugin's configuration. This vulnerability arises from insufficient access control on critical plugin functions.

Any authenticated user, regardless of privilege level, can read and delete administrator scan data and overwrite the plugin's configuration. This could lead to unauthorized disclosure of sensitive information and disruption or manipulation of the plugin's behavior, potentially impacting website functionality and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and monitor for suspicious activity related to the plugin's AJAX actions.