CVE-2026-15388

Name of the Vulnerable Software and Affected Versions Cookie Consent WordPress plugin versions prior to 0.0.10

Description Insufficient capability checks on the 'consent-settings' REST routes allow any authenticated user, including those with subscriber-level privileges, to modify the plugin settings. Additionally, on sites utilizing the vendor's paid plan, authenticated users can read stored visitor consent logs.

Recommendations Update Cookie Consent WordPress plugin to version 0.0.10 or later.