Executive brief
My Agile Privacy is a WordPress plugin that manages cookie consent and privacy settings for websites. An authorization bypass vulnerability allows unauthenticated attackers to modify critical plugin settings without proper authentication, potentially exposing users to tracking and privacy violations.
Technical details
The plugin fails to properly verify user authorization before allowing settings modifications. This is a classic authorization bypass vulnerability affecting an unauthenticated attack vector. Attackers can modify sensitive settings including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation stored in the plugin's configuration. No authentication or special privileges are required. Patches are available in versions later than 3.3.6.
Affected products
- My Agile Privacy My Agile Privacy up to and including 3.3.6
Timeline
- 2026-08-25: disclosed