CVE-2026-15388

The Cookie Consent WordPress plugin (versions before 0.0.10 ) contains an authorization flaw where it fails to properly enforce administrator-only capability checks on its consent-settings REST routes . Instead, these routes fall back to a general authentication-only gate. This allows any authent...

CVE-2026-15388 Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...