# WPLP Cookie Consent <= 4.4.8 - Unauthenticated Missing Authorization to Google Consent Mode Scan Result Overwrite via update_gcm_status REST Endpoint

- **ID:** WPSEC-2026-2504
- **Plugin:** WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode (`gdpr-cookie-consent`), https://wordpress.org/plugins/gdpr-cookie-consent/
- **Affected versions:** all versions before 4.5.0
- **Fixed in:** 4.5.0 (Update to 4.5.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gdpr-cookie-consent
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2504/

## Description

The WPLP Cookie Consent plugin for WordPress is vulnerable to Missing Authorization on its Google Consent Mode status update REST endpoint (update_gcm_status) in all versions up to, and including, 4.4.8. On any site that has connected its account, the endpoint's permission callback returns true for every caller, so unauthenticated attackers can overwrite the stored Google Consent Mode scan result shown to administrators and trigger an administrator notification email containing attacker-controlled content. Version 4.5.0 adds an HMAC signature check on the endpoint.

## References

- https://wpsec.com/vuln/WPSEC-2026-2504/
- https://plugins.svn.wordpress.org/gdpr-cookie-consent/tags/4.5.0/
- https://wordpress.org/plugins/gdpr-cookie-consent/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2504/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.