CVE-2026-15388

Katalog CVE

CVSS 4.3 · Medium EPSS 0,33%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 4.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.

Rincian

Terbit di NVD

12 Agustus 2026

Terakhir diubah

26 Agustus 2026

Status NVD

Deferred

CVSS 3.1

4.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1/