CVE-2026-17587: My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions
The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify plugin settings including missingcookieshield, cookieshieldrunning, cmodev2jsonerror, cmodev2jserrorcode, and cmodev2jserrormotivation stored in the plugin's settings key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.3.6 - Configuration
Apply an authorization check so that plugin settings modifications (including missing_cookie_shield) are only allowed for authenticated/authorized users.
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (WordPress plugin) missing_cookie_shield = ensure only authorized users can modify this setting - Configuration
Apply an authorization check so that plugin settings modifications (including cookie_shield_running) are only allowed for authenticated/authorized users.
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (WordPress plugin) cookie_shield_running = ensure only authorized users can modify this setting - Configuration
Apply an authorization check so that plugin settings modifications (including cmode_v2_js_on_error) are only allowed for authenticated/authorized users.
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (WordPress plugin) cmode_v2_js_on_error = ensure only authorized users can modify this setting - Configuration
Apply an authorization check so that plugin settings modifications (including cmode_v2_js_error_code) are only allowed for authenticated/authorized users.
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (WordPress plugin) cmode_v2_js_error_code = ensure only authorized users can modify this setting - Configuration
Apply an authorization check so that plugin settings modifications (including cmode_v2_js_error_motivation) are only allowed for authenticated/authorized users.
My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (WordPress plugin) cmode_v2_js_error_motivation = ensure only authorized users can modify this setting
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated attackers can exploit it remotely; no account or user interaction is required. The affected attack surface is exposed through the map_missing_cookie_shield and map_check_consent_mode_status AJAX actions.
Which settings can an attacker modify?
An attacker can modify plugin settings including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation. These values are stored in the plugin's settings key.
Which versions are affected?
All versions of the My Agile Privacy® – CMP, Cookie Consent & Privacy Tools WordPress plugin through 3.3.6, including 3.3.6, are affected.