CVE-2026-24604: Simple GDPR Cookie Auth Bypass Flaw

CVE-2026-24604 Overview

CVE-2026-24604 is a Missing Authorization vulnerability [CWE-862] in the themebeez Simple GDPR Cookie Compliance WordPress plugin. The flaw affects all versions up to and including 2.0.0. Attackers can exploit incorrectly configured access control security levels to invoke plugin functionality without proper authorization checks. The vulnerability is network-exploitable, requires no authentication, and needs no user interaction. Successful exploitation impacts data integrity on affected WordPress sites running the vulnerable plugin.

Critical Impact
Unauthenticated attackers can interact with protected plugin actions and modify limited site state on any WordPress instance running Simple GDPR Cookie Compliance through version 2.0.0.

Affected Products

themebeez Simple GDPR Cookie Compliance plugin for WordPress
All versions from initial release through 2.0.0
WordPress sites with the simple-gdpr-cookie-compliance plugin installed and active

Discovery Timeline

2026-01-23 - CVE-2026-24604 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-24604

Vulnerability Analysis

The Simple GDPR Cookie Compliance plugin exposes one or more action handlers that lack proper authorization enforcement. Under the Common Weakness Enumeration taxonomy, this maps to [CWE-862] Missing Authorization. The plugin registers endpoints intended for privileged users but fails to verify the caller's capability or nonce before executing the requested action.

An attacker reaches the vulnerable handler through standard WordPress request paths such as admin-ajax.php or REST routes. Because the plugin does not validate the requester's role against a WordPress capability check like current_user_can(), the handler executes for any HTTP caller. This grants effective access to functionality reserved for higher-privileged accounts.

The impact is limited to integrity. An attacker cannot directly read confidential data or trigger denial of service through this flaw, but can alter plugin state or configuration values exposed by the unguarded action.

Root Cause

The root cause is missing access control on plugin action handlers. WordPress plugins must pair every privileged endpoint with both a capability check and a nonce verification call. The vulnerable code path omits the capability check, treating any authenticated or unauthenticated request as legitimate.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted HTTP request to the WordPress site's AJAX or REST endpoint registered by the plugin. No credentials, social engineering, or local access are required. The request invokes the protected plugin function, which executes with the privileges intended for site administrators.

For technical specifics on the vulnerable code paths, refer to the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2026-24604

Indicators of Compromise

Unexpected modifications to Simple GDPR Cookie Compliance plugin settings in the WordPress wp_options table
HTTP POST requests to /wp-admin/admin-ajax.php referencing plugin-specific action names from unauthenticated sessions
Access log entries showing plugin endpoint hits from IP addresses not associated with administrator activity

Detection Strategies

Inventory WordPress installations and flag any site running simple-gdpr-cookie-compliance at version 2.0.0 or earlier
Review web server access logs for repeated requests to plugin action handlers without preceding administrator login events
Alert on changes to plugin configuration options that occur outside expected administrator working hours

Monitoring Recommendations

Forward WordPress application logs and web server access logs to a centralized logging or SIEM platform for correlation
Track plugin version inventory across WordPress fleets and trigger alerts when vulnerable versions appear
Monitor for anomalous request patterns targeting admin-ajax.php and REST API routes registered by the plugin

How to Mitigate CVE-2026-24604

Immediate Actions Required

Identify all WordPress sites running Simple GDPR Cookie Compliance version 2.0.0 or earlier
Deactivate the plugin on affected sites until a fixed version is installed
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible using a web application firewall

Patch Information

At the time of NVD publication, the advisory lists affected versions through 2.0.0 with no fixed version specified. Monitor the Patchstack Vulnerability Advisory and the vendor's WordPress.org plugin page for an updated release that adds capability and nonce checks to the affected handlers.

Workarounds

Remove or deactivate the simple-gdpr-cookie-compliance plugin and replace it with a maintained alternative
Deploy a web application firewall rule that blocks unauthenticated requests to the plugin's specific AJAX action names
Restrict access to WordPress administrative endpoints by source IP where the site's user base permits

bash

# Example: list and disable the vulnerable plugin using WP-CLI
wp plugin list --name=simple-gdpr-cookie-compliance --fields=name,status,version
wp plugin deactivate simple-gdpr-cookie-compliance