CVE-2026-15388: Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cookie Consent WordPress pluginto a version that resolves this vulnerability.Fixed in 0.0.10 - Compensating control
Apply access control to the Cookie Consent consent-settings REST routes so only administrators can call them (block subscriber/authenticated users at the application or via a WAF/reverse proxy rule).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15388?
CVE-2026-15388 has a severity score of 40, indicating a moderate risk level.
How do I fix CVE-2026-15388?
To fix CVE-2026-15388, update the Cookie Consent WordPress plugin to version 0.0.10 or later.
What impact does CVE-2026-15388 have on my WordPress site?
CVE-2026-15388 allows authenticated users, like subscribers, to update consent settings and disclose the consent log, compromising admin controls.
Who is affected by CVE-2026-15388?
CVE-2026-15388 affects all versions of the Cookie Consent WordPress plugin prior to 0.0.10.
Is CVE-2026-15388 an authenticated vulnerability?
Yes, CVE-2026-15388 requires an authenticated user to exploit the vulnerability, but it bypasses intended administrator checks.