{
 "id": "WPSEC-2026-2504",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2504/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2504/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2504/index.md",
 "title": "WPLP Cookie Consent <= 4.4.8 - Unauthenticated Missing Authorization to Google Consent Mode Scan Result Overwrite via update_gcm_status REST Endpoint",
 "description": "The WPLP Cookie Consent plugin for WordPress is vulnerable to Missing Authorization on its Google Consent Mode status update REST endpoint (update_gcm_status) in all versions up to, and including, 4.4.8. On any site that has connected its account, the endpoint's permission callback returns true for every caller, so unauthenticated attackers can overwrite the stored Google Consent Mode scan result shown to administrators and trigger an administrator notification email containing attacker-controlled content. Version 4.5.0 adds an HMAC signature check on the endpoint.",
 "plugin": {
  "slug": "gdpr-cookie-consent",
  "name": "WPLP Cookie Consent",
  "full_name": "WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode",
  "wordpress_org": "https://wordpress.org/plugins/gdpr-cookie-consent/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gdpr-cookie-consent/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gdpr-cookie-consent"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.0",
 "remediation": "Update to 4.5.0 or later.",
 "fix_released": "2026-11-03T11:16:31+00:00",
 "published": "2026-11-04T15:47:10+00:00",
 "updated": "2026-11-04T15:46:29.874722+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2504/",
  "https://plugins.svn.wordpress.org/gdpr-cookie-consent/tags/4.5.0/",
  "https://wordpress.org/plugins/gdpr-cookie-consent/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gdpr-cookie-consent",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}