Executive brief
The Cookie Consent WordPress plugin before version 0.0.10 contains a privilege escalation vulnerability in its REST API endpoint that manages geolocation licensing. Any subscriber-level user can bypass intended administrator-only checks and modify the plugin's MaxMind geolocation license key, causing disruption to the plugin's consent banner functionality and potentially exposing the site to unauthorized third-party access.
Technical details
The plugin fails to enforce proper capability checks on the REST route /wp-json/cookiez/v1/settings/maxmind-license-key, falling back to an authentication-only gate instead of requiring administrator capabilities. This permits any authenticated user (including subscribers) to POST requests that overwrite the MaxMind license key option. The vulnerability affects versions before 0.0.10; an attacker with a subscriber account can obtain a REST nonce from the WordPress dashboard and craft a POST request with modified license key data. While the plugin masks the stored key as "DO_NOT_SHOW" in the UI, the replacement persists in the options table. The fix is available in version 0.0.10 and later.
Affected products
- Cookie Consent Cookie Consent before 0.0.10
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in version 0.0.10