GDPR Cookie Consent & Compliance Notice <= 3.5.7 - Unauthenticated Cookie Consent Bypass via 'cli_bypass' Parameter
- ID
- WPSEC-2026-1823
- Plugin
- CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) (cookie-law-info)
- Affected
- from 2.0.0 before 3.5.8
- Remediation
- Update to 3.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Weakness
- CWE-807
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-28
- Attack surface
- GDPR Cookie Consent & Compliance Notice on WPSec AttackSurface
- Fix released
- Published
Description
The Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) plugin for WordPress is vulnerable to a cookie consent bypass via the 'cli_bypass' query parameter in all versions up to, and including, 3.5.7. This is due to the front-end script blocker lifting consent-based blocking whenever the URL contains cli_bypass=1, and the server-side consent check trusting that parameter whenever the CLI_BYPASS option is set, an option that is enabled when a cookie scan starts and is not cleared when the scan completes. This makes it possible for unauthenticated attackers to craft links that make consent-gated tracking and third-party scripts load for visitors who have not given consent. In 3.0.0 and later, only sites still running the plugin's legacy mode (settings carried over from 2.x and never migrated to the 3.0 interface) are affected.
References
- https://wpsec.com/vuln/WPSEC-2026-1823/
- https://plugins.svn.wordpress.org/cookie-law-info/tags/3.5.8/
- https://wordpress.org/plugins/cookie-law-info/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS