Vulnerabilities / WPLP Cookie Consent / WPSEC-2026-2504
WPLP Cookie Consent <= 4.4.8 - Unauthenticated Missing Authorization to Google Consent Mode Scan Result Overwrite via update_gcm_status REST Endpoint
Medium 5.3
CWE-862Fixed in 4.5.0
- ID
- WPSEC-2026-2504
- Plugin
- WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode (gdpr-cookie-consent)
- Affected
- all versions before 4.5.0
- Remediation
- Update to 4.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- WPLP Cookie Consent on WPSec AttackSurface
- Fix released
- Published
Description
The WPLP Cookie Consent plugin for WordPress is vulnerable to Missing Authorization on its Google Consent Mode status update REST endpoint (update_gcm_status) in all versions up to, and including, 4.4.8. On any site that has connected its account, the endpoint's permission callback returns true for every caller, so unauthenticated attackers can overwrite the stored Google Consent Mode scan result shown to administrators and trigger an administrator notification email containing attacker-controlled content. Version 4.5.0 adds an HMAC signature check on the endpoint.
References
- https://wpsec.com/vuln/WPSEC-2026-2504/
- https://plugins.svn.wordpress.org/gdpr-cookie-consent/tags/4.5.0/
- https://wordpress.org/plugins/gdpr-cookie-consent/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS