CVE-2026-18046

Name of the Vulnerable Software and Affected Versions Cookie Consent versions prior to 0.0.10

Description An issue exists where the plugin fails to correctly enforce an administrator-only capability check on the REST route used to store the geolocation service license key. Consequently, the route defaults to a basic authentication check, enabling any authenticated user, including those with subscriber-level privileges, to overwrite the stored license key. This action can disrupt the geolocation-based consent banner targeting.

Recommendations Update to version 0.0.10 or later.