CVE-2026-85132: WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPLP Cookie Consentto a version that resolves this vulnerability.Fixed in 4.4.2
Event History
Frequently Asked Questions
Which users can access the configured cookie scan schedule?
Any authenticated WordPress user can access it, including users with the Subscriber role. The affected AJAX action lacks both nonce validation and capability checks.
What information is exposed through this issue?
An authenticated attacker can read the automated cookie scan schedule configured by an administrator. The provided data does not indicate that scan results, cookies, or other site data can be modified or disclosed.
Which plugin versions are affected?
WPLP Cookie Consent versions before 4.4.2 are affected. Versions 4.0.2 through 4.4.1 are specifically identified.