# CVE-2026-15388: WordPress Cookie Consent privilege escalation in REST API

Source: https://junglewise.ai/threats/cve-2026-15388-wordpress-cookie-consent-privilege-escalation-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15388 · Severity: medium · CVSS 4.3 · Published 2026-08-12

The Cookie Consent WordPress plugin allows authenticated users with low-level permissions (such as subscribers) to modify sensitive plugin settings and access visitor consent logs that should only be accessible to administrators. An attacker with a subscriber account can disable consent banners, allow tracking before consent is given, and on paid plans, exfiltrate stored visitor consent data.

## Quick answers

**Is CVE-2026-15388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15388 being exploited in the wild.

**How severe is CVE-2026-15388?** Medium severity, with a CVSS score of 4.3, published 12 August 2026.

**Which products and versions are affected?** cookiez Cookie Consent before 0.0.10.

**Is there a fix for CVE-2026-15388?** A patch was published on 2026-08-10: Fixed in version 0.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15388 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15388?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin implements incorrect authorization checks on its REST API consent-settings routes (update-settings, get-consent-logs, export-consent-logs), falling back to authentication-only validation instead of enforcing administrator-capability requirements. An authenticated subscriber can extract a WordPress REST nonce from the dashboard and use it with their session cookies to POST requests that modify the cookiez_settings option or retrieve consent logs. The vulnerability requires a valid WordPress account with Subscriber role or higher, and affects versions before 0.0.10. Patches are available in version 0.0.10.

## Affected products

- cookiez Cookie Consent before 0.0.10

## Timeline

- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in version 0.0.10

## References

- [https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1/](https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1/)