# GDPR Cookie Consent & Compliance Notice <= 3.5.7 - Unauthenticated Cookie Consent Bypass via 'cli_bypass' Parameter

- **ID:** WPSEC-2026-1823
- **Plugin:** CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) (`cookie-law-info`), https://wordpress.org/plugins/cookie-law-info/
- **Affected versions:** from 2.0.0 before 3.5.8
- **Fixed in:** 3.5.8 (Update to 3.5.8 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-807
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cookie-law-info
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1823/

## Description

The Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) plugin for WordPress is vulnerable to a cookie consent bypass via the 'cli_bypass' query parameter in all versions up to, and including, 3.5.7. This is due to the front-end script blocker lifting consent-based blocking whenever the URL contains cli_bypass=1, and the server-side consent check trusting that parameter whenever the CLI_BYPASS option is set, an option that is enabled when a cookie scan starts and is not cleared when the scan completes. This makes it possible for unauthenticated attackers to craft links that make consent-gated tracking and third-party scripts load for visitors who have not given consent. In 3.0.0 and later, only sites still running the plugin's legacy mode (settings carried over from 2.x and never migrated to the 3.0 interface) are affected.

## References

- https://wpsec.com/vuln/WPSEC-2026-1823/
- https://plugins.svn.wordpress.org/cookie-law-info/tags/3.5.8/
- https://wordpress.org/plugins/cookie-law-info/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1823/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.