CVE-2024-35692 Overview
CVE-2024-35692 is a missing authorization vulnerability in the Termly Cookie Consent plugin for WordPress. The flaw affects all versions of the gdpr_cookie_consent_banner plugin from initial release through version 3.2. The plugin fails to enforce capability checks on sensitive operations, allowing low-privileged or unauthenticated users to invoke functionality that should be restricted to administrators. The issue is tracked under CWE-862: Missing Authorization.
Critical Impact
Network-accessible attackers can manipulate cookie consent banner configuration on affected WordPress sites without proper authorization, potentially affecting site compliance posture and user trust.
Affected Products
- Termly GDPR/CCPA Cookie Consent Banner Plugin for WordPress
- Versions up to and including 3.2
- WordPress sites using termly:gdpr_cookie_consent_banner
Discovery Timeline
- 2024-06-11 - CVE-2024-35692 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-35692
Vulnerability Analysis
The vulnerability resides in the Termly Cookie Consent plugin's request handling logic. Specific plugin actions do not validate whether the requesting user holds the required capability before executing privileged operations. This is a broken access control flaw categorized as [CWE-862].
According to the Patchstack Security Vulnerability Report, the issue affects all plugin versions up to 3.2. The attack requires no user interaction and can be triggered remotely over the network. Successful exploitation results in limited impact to confidentiality, integrity, and availability of the affected WordPress instance.
Root Cause
The root cause is the absence of a proper authorization check, typically a missing current_user_can() capability verification or check_ajax_referer() nonce validation, on plugin AJAX or admin handlers. The plugin exposes administrative functionality without confirming that the caller has the necessary role to execute it.
Attack Vector
An attacker sends a crafted HTTP request to the vulnerable WordPress endpoint exposed by the plugin. Because authorization is not enforced, the server processes the request even when issued by a user without the required privileges. The vulnerability is exploitable over the network with low attack complexity and no privileges or user interaction required.
No public proof-of-concept exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.139%, placing it in the 33.7th percentile for likelihood of exploitation.
Detection Methods for CVE-2024-35692
Indicators of Compromise
- Unexpected modifications to cookie consent banner configuration, content, or scripts on WordPress sites running the Termly plugin
- HTTP POST requests to plugin AJAX endpoints (/wp-admin/admin-ajax.php) from unauthenticated sessions or low-privileged accounts referencing Termly plugin actions
- WordPress option table entries related to the Termly plugin being changed outside expected administrative workflows
Detection Strategies
- Inventory all WordPress installations and identify sites running gdpr_cookie_consent_banner version 3.2 or earlier
- Review web server access logs for requests targeting plugin endpoints originating from non-admin IP addresses or session contexts
- Monitor WordPress audit logs for configuration changes to the Termly plugin made by accounts lacking administrator capabilities
Monitoring Recommendations
- Deploy a web application firewall rule to flag unauthenticated requests to Termly plugin AJAX actions
- Enable WordPress activity logging plugins to record privileged option changes and administrative API calls
- Forward web server and WordPress logs to a centralized SIEM for correlation and alerting on access control anomalies
How to Mitigate CVE-2024-35692
Immediate Actions Required
- Upgrade the Termly Cookie Consent plugin to a version later than 3.2 that contains the authorization fix
- Audit existing plugin configuration and banner content to verify no unauthorized modifications have been made
- Restrict access to /wp-admin/ paths by IP address where operationally feasible until patching is complete
Patch Information
The vendor has released a patched version of the plugin addressing the missing authorization check. Site administrators should update through the WordPress plugin manager or download the latest release directly from the plugin repository. Refer to the Patchstack advisory for the fixed version reference.
Workarounds
- Temporarily deactivate the Termly Cookie Consent plugin until the patched version is installed
- Apply a web application firewall rule blocking unauthenticated POST requests to plugin-specific AJAX actions
- Limit administrative dashboard access to known IP ranges using server-level or .htaccess restrictions
# WP-CLI commands to inventory and update the affected plugin
wp plugin list --name=uk-cookie-consent --fields=name,status,version
wp plugin update uk-cookie-consent
wp plugin get uk-cookie-consent --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
