{"id":"CVE-2026-15388","aliases":["EUVD-2026-57084","GHSA-m52v-mw7v-c5gf"],"status":"published","title":"Cookie Consent \u003c 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure","description":"The Cookie Consent  WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent  WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00333,"percentile":0.26824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-08-12T06:00:14Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"termly","product":"cookie consent"},{"vendor":"unknown","product":"cookie consent"}],"references":[{"url":"https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15388"},{"url":"https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1"},{"url":"https://github.com/advisories/GHSA-m52v-mw7v-c5gf"}],"sources":{"cve":[{"id":"CVE-2026-15388","title":"Cookie Consent \u003c 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure","description":"The Cookie Consent  WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent  WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.","status":"published","published":"2026-08-12T06:00:14.468Z","modified":"2026-08-12T19:32:05.878Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-57084","description":"The Cookie Consent  WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent  WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.","status":"published","published":"2026-08-12T06:00:14Z","modified":"2026-08-12T19:32:05Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:57.602969Z"}],"ghsa":[{"id":"GHSA-m52v-mw7v-c5gf","title":"The Cookie Consent  WordPress plugin before 0.0.10 does not correctly enforce its intended...","description":"The Cookie Consent  WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent  WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.","status":"published","published":"2026-08-12T06:30:50Z","modified":"2026-08-12T21:31:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:23.958572Z"}],"nvd":[{"id":"CVE-2026-15388","description":"The Cookie Consent  WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent  WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.","status":"published","published":"2026-08-12T06:18:09.547Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:36.880938Z"}]}}