CVE-2026-12955: WordPress GDPR Plugin Auth Bypass Flaw

CVE-2026-12955 Overview

CVE-2026-12955 is a missing authorization vulnerability in the GDPR Cookie Consent plugin for WordPress. The flaw affects all versions up to and including 4.3.6. The gdpr_cookie_consent_ajax_save_schedule_scan() function, exposed through the wp_ajax_gcc_save_schedule_scan AJAX action, lacks both a capability check and nonce verification. Authenticated users with Subscriber-level access or higher can modify the plugin's cookie scan schedule configuration stored in the gdpr_scan_schedule_data option. This administrative function was intended to be restricted to users holding the manage_options capability.

Critical Impact
Any authenticated WordPress user, including low-privileged Subscribers, can alter administrative scan schedule settings on affected sites.

Affected Products

GDPR Cookie Consent plugin for WordPress, versions up to and including 4.3.6
Fixed in version 4.3.7
WordPress sites allowing Subscriber-level registration are at greatest risk

Discovery Timeline

2026-07-10 - CVE-2026-12955 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-12955

Vulnerability Analysis

The vulnerability is a broken access control issue classified under [CWE-862] Missing Authorization. The plugin registers wp_ajax_gcc_save_schedule_scan to invoke gdpr_cookie_consent_ajax_save_schedule_scan(). This handler updates the gdpr_scan_schedule_data WordPress option, which controls when and how the plugin performs cookie scans on the site.

WordPress AJAX handlers registered under wp_ajax_ are reachable by any authenticated user by default. Secure implementations must call current_user_can('manage_options') and validate a nonce with check_ajax_referer() before performing privileged actions. The affected handler does neither.

The consequence is limited to integrity impact on plugin configuration. There is no direct disclosure of confidential data and no denial-of-service condition. However, attackers can disable or misconfigure automated cookie compliance scans, undermining the site's GDPR posture.

Root Cause

The root cause is the absence of authorization enforcement inside the AJAX callback. The handler assumes any user reaching it is an administrator. It also omits nonce verification, so requests are not tied to a legitimate admin workflow. Both controls are standard requirements for WordPress administrative AJAX endpoints.

Attack Vector

An attacker first authenticates to the target WordPress site with any account of Subscriber role or above. The attacker then issues a crafted POST request to /wp-admin/admin-ajax.php with action=gcc_save_schedule_scan and controlled schedule parameters. The plugin persists the attacker-supplied values into the gdpr_scan_schedule_data option without further validation.

See the Wordfence Vulnerability Report and the vendor patch changeset for technical details on the fix.

Detection Methods for CVE-2026-12955

Indicators of Compromise

Unexpected changes to the gdpr_scan_schedule_data option in the wp_options table
POST requests to /wp-admin/admin-ajax.php containing action=gcc_save_schedule_scan originating from non-administrator user sessions
Cookie scan jobs running or failing at times inconsistent with configured administrator behavior

Detection Strategies

Audit WordPress access logs for requests to admin-ajax.php with the gcc_save_schedule_scan action correlated against the authenticated user's role
Query the WordPress database periodically to hash the gdpr_scan_schedule_data option value and alert on unauthorized modification
Deploy a WordPress activity log plugin that records option changes and AJAX invocations with user attribution

Monitoring Recommendations

Enable verbose web server logging on wp-admin/admin-ajax.php including request bodies where policy permits
Alert on any Subscriber, Contributor, or Author role account invoking AJAX actions tied to plugin administration
Monitor for creation of low-privilege user accounts followed shortly by AJAX activity targeting plugin endpoints

How to Mitigate CVE-2026-12955

Immediate Actions Required

Update the GDPR Cookie Consent plugin to version 4.3.7 or later on every WordPress installation
Review the current value of the gdpr_scan_schedule_data option and restore known-good configuration if tampering is suspected
Audit existing user accounts and remove unrecognized Subscriber-level or higher accounts

Patch Information

The vendor released version 4.3.7 addressing the missing authorization and nonce checks. The fix is visible in the WordPress plugin changeset 3601475, which introduces capability and nonce validation inside the AJAX handler.

Workarounds

Disable open user registration in WordPress settings until the plugin is updated
Temporarily deactivate the GDPR Cookie Consent plugin if immediate patching is not possible
Restrict access to /wp-admin/admin-ajax.php at the web application firewall layer, blocking the gcc_save_schedule_scan action for non-administrator sessions

bash

# Example WAF rule concept blocking the vulnerable action for non-admin roles
# Deny POST to admin-ajax.php where action=gcc_save_schedule_scan
# unless the request originates from an authenticated administrator session
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1029551,msg:'Block CVE-2026-12955 exploit attempt'"
  SecRule ARGS:action "@streq gcc_save_schedule_scan"