# CVE-2026-18046: Cookie Consent WordPress plugin privilege escalation in REST API

Source: https://junglewise.ai/threats/cve-2026-18046-cookie-consent-wordpress-plugin-privilege-escalation-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18046 · Severity: medium · CVSS 4.3 · Published 2026-08-12

The Cookie Consent WordPress plugin before version 0.0.10 contains a privilege escalation vulnerability in its REST API endpoint that manages geolocation licensing. Any subscriber-level user can bypass intended administrator-only checks and modify the plugin's MaxMind geolocation license key, causing disruption to the plugin's consent banner functionality and potentially exposing the site to unauthorized third-party access.

## Quick answers

**Is CVE-2026-18046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18046 being exploited in the wild.

**How severe is CVE-2026-18046?** Medium severity, with a CVSS score of 4.3, published 12 August 2026.

**Which products and versions are affected?** Cookie Consent Cookie Consent before 0.0.10.

**Is there a fix for CVE-2026-18046?** A patch was published on 2026-08-10: Fixed in version 0.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18046 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18046?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to enforce proper capability checks on the REST route /wp-json/cookiez/v1/settings/maxmind-license-key, falling back to an authentication-only gate instead of requiring administrator capabilities. This permits any authenticated user (including subscribers) to POST requests that overwrite the MaxMind license key option. The vulnerability affects versions before 0.0.10; an attacker with a subscriber account can obtain a REST nonce from the WordPress dashboard and craft a POST request with modified license key data. While the plugin masks the stored key as "DO_NOT_SHOW" in the UI, the replacement persists in the options table. The fix is available in version 0.0.10 and later.

## Affected products

- Cookie Consent Cookie Consent before 0.0.10

## Timeline

- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in version 0.0.10

## References

- [https://wpscan.com/vulnerability/4f5ee68e-3513-4f05-839e-60ae62349f93/](https://wpscan.com/vulnerability/4f5ee68e-3513-4f05-839e-60ae62349f93/)