CVE-2026-12955: GDPR Cookie Consent Plugin WordPress Privilege Escalation Vulnerability

Technical summary

CVE-2026-12955 affects the GDPR Cookie Consent plugin up to version 4.3.6. The vulnerability exists in the gdpr_cookie_consent_ajax_save_schedule_scan() AJAX handler (wp_ajax_gcc_save_schedule_scan action) which fails to perform two critical security checks: capability verification and nonce validation. This allows any authenticated user, including those with only Subscriber-level access, to call this administrative function and modify the gdpr_scan_schedule_data option. The affected function lacks the check_ajax_referer() call needed to verify request authenticity and does not validate that the requesting user possesses manage_options capability, which is required for administrative plugin configuration. CWE-862 (Missing Authorization) is the root cause.

Business impact

An attacker with low-privilege site access—such as a contributor, subscriber, or any authenticated user—can disrupt the plugin's core functionality by altering its scan schedule. This can prevent legitimate cookie compliance scanning from running, potentially leaving a website non-compliant with GDPR requirements and exposing the organization to regulatory scrutiny. The integrity of compliance records and configuration is compromised without requiring administrative intervention, introducing governance and audit trail concerns.

Affected systems

GDPR Cookie Consent plugin for WordPress versions 4.3.6 and earlier are vulnerable. Organizations using this plugin on WordPress sites should verify their installed version. Self-hosted WordPress deployments and managed WordPress hosting platforms where this plugin is active are within scope.

Exploitability

This vulnerability has low barriers to exploitation. It requires only network access and valid WordPress authentication credentials at the Subscriber level or above—accounts that are commonly provisioned for contributors, consultants, or other non-administrative users. No special tools, zero-day techniques, or elevated privileges are needed. An attacker with a compromised or created low-privilege account can immediately modify plugin settings via a simple AJAX request. The attack is not present in KEV catalogs, indicating it has not yet been reported as actively exploited in the wild, but the ease of exploitation means defensive measures should not be delayed.

Remediation

Update the GDPR Cookie Consent plugin to a patched version released after 4.3.6. Verify the patch version against the official plugin repository or vendor advisory to confirm the vulnerability has been addressed. Until patching is possible, restrict plugin usage or temporarily disable the cookie scan schedule feature if operationally feasible. Additionally, review and minimize the number of users with authenticated access to WordPress, particularly those with Subscriber or Contributor roles on production sites.

Patch guidance

Administrators should check the official GDPR Cookie Consent plugin page on wordpress.org for available updates and apply the latest version. Test patches in a staging environment before deploying to production to ensure no conflicts with site functionality or other plugins. Verify that the patched version explicitly addresses the missing capability check and nonce validation in the AJAX handler. After patching, audit the gdpr_scan_schedule_data option to confirm it has not been maliciously altered.

Detection guidance

Monitor WordPress audit logs and AJAX request logs for repeated calls to the wp_ajax_gcc_save_schedule_scan action, particularly from low-privilege user accounts or during unusual times. Check for unexpected modifications to the gdpr_scan_schedule_data option using site security plugins that track database changes. Review WordPress user activity logs for Subscriber or Contributor accounts performing administrative actions. If you have access to server logs, search for POST requests to /wp-admin/admin-ajax.php with the action parameter set to gcc_save_schedule_scan originating from non-administrative users.

Why prioritize this

Although this vulnerability carries a CVSS score of 4.3 (Medium severity) and is not yet exploited in the wild, it should be prioritized for patching because (1) exploitation is trivial—requiring only valid low-privilege credentials; (2) the affected plugin is common on privacy-conscious sites that depend on it for compliance; (3) the integrity of compliance settings is at stake, creating audit and legal risk; and (4) patch deployment is straightforward. Organizations should treat this as a moderate-priority but time-sensitive update.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium-severity vulnerability with low attack complexity, requiring only low-privilege authentication (PR:L), and delivering integrity impact (I:L) without confidentiality or availability consequences. The Network vector (AV:N) and lack of user interaction (UI:N) keep the score from being lower. The score appropriately captures that this is a privilege escalation issue: while the direct impact is limited to a single option's modification, the unauthorized nature of that modification and the potential for compliance disruption warrant immediate attention.

Frequently asked questions