CVE-2026-15388: Cookie Consent Auth Bypass Vulnerability

CVE-2026-15388 Overview

CVE-2026-15388 is a broken access control vulnerability in the Cookie Consent WordPress plugin before version 0.0.10. The plugin fails to enforce its intended administrator-only capability check on its consent-settings REST routes. Instead, the routes fall back to an authentication-only gate, so any authenticated user, including a low-privileged subscriber, can update the plugin's consent settings. On sites connected to the vendor's paid plan, the same flaw allows authenticated users to read stored visitor consent logs. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Any authenticated WordPress user, including subscribers, can modify cookie consent settings and access stored visitor consent logs on paid-plan sites.

Affected Products

Cookie Consent WordPress plugin versions prior to 0.0.10
WordPress sites using the plugin with any authenticated user role
WordPress sites connected to the vendor's paid plan (additional data exposure)

Discovery Timeline

2026-08-12 - CVE-2026-15388 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15388

Vulnerability Analysis

The Cookie Consent plugin registers REST API routes intended to manage consent settings. These routes are documented and coded to require administrator-level capabilities. The permission_callback associated with the routes does not correctly verify the caller's capability. Instead, the check reduces to an is_user_logged_in() style gate. Any authenticated session token, regardless of role, satisfies this gate.

An authenticated subscriber can therefore issue REST requests that mutate the plugin's consent configuration. On sites connected to the vendor's paid plan, the same authorization gap exposes read endpoints that return stored visitor consent logs. This data can include timestamps, consent choices, and other visitor-tied metadata.

The vulnerability requires low privileges and no user interaction. It affects confidentiality of consent-log data but does not by itself grant integrity or availability impact to the broader site.

Root Cause

The root cause is an incorrect authorization implementation on REST route registration. The plugin's permission_callback does not call current_user_can('manage_options') or an equivalent capability check. It effectively permits any authenticated user to invoke administrator-only endpoints, matching the [CWE-863] pattern of enforcing the wrong authorization decision.

Attack Vector

Exploitation is network-based over HTTP or HTTPS against the WordPress REST API. An attacker registers or compromises any low-privileged account, such as a subscriber account created through open registration. The attacker then sends authenticated REST requests to the plugin's consent-settings endpoints to overwrite configuration or, on paid-plan sites, to enumerate stored consent logs. Refer to the WPScan Vulnerability Report for endpoint details.

Detection Methods for CVE-2026-15388

Indicators of Compromise

Unexpected changes to Cookie Consent plugin settings without corresponding administrator activity in WordPress audit logs.
REST API requests to the plugin's consent-settings routes originating from subscriber, contributor, or author accounts.
Bursts of authenticated GET requests to consent-log endpoints on paid-plan sites from non-administrator users.
New low-privileged user registrations followed by authenticated REST API activity targeting /wp-json/ routes for the plugin.

Detection Strategies

Review web server access logs for authenticated requests to /wp-json/ paths associated with the Cookie Consent plugin from non-administrator sessions.
Correlate WordPress user role data with REST API request logs to flag privilege-role mismatches on plugin endpoints.
Alert on plugin configuration changes that occur outside of administrator UI sessions.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture REST API calls, user role changes, and plugin setting modifications.
Ingest WordPress and web server logs into a centralized SIEM to build detection rules for low-privileged users invoking privileged REST routes.
Monitor new-user registration rates and correlate with subsequent REST API activity to identify automated exploitation attempts.

How to Mitigate CVE-2026-15388

Immediate Actions Required

Update the Cookie Consent WordPress plugin to version 0.0.10 or later on all affected sites.
Audit recent plugin setting changes and, on paid-plan sites, review access to stored visitor consent logs.
Review and remove unnecessary low-privileged accounts, and disable open user registration where it is not required.

Patch Information

Upgrade the Cookie Consent plugin to version 0.0.10 or later, which enforces the correct capability check on the consent-settings REST routes. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable or remove the Cookie Consent plugin until the site can be upgraded to version 0.0.10 or later.
Restrict access to /wp-json/ REST endpoints for the plugin at the web server or WAF layer to administrator IPs where feasible.
Set users_can_register to false in WordPress general settings to prevent creation of new low-privileged accounts that could be used for exploitation.

bash

# Disable open registration via WP-CLI
wp option update users_can_register 0

# Update the affected plugin
wp plugin update cookie-consent --version=0.0.10