Unauthorized Data Modification in GDPR Cookie Consent WordPress Plugin

Executive Summary

The GDPR Cookie Consent plugin for WordPress has a vulnerability in versions up to and including 4.3.6. This vulnerability arises because the function gdpr_cookie_consent_ajax_save_schedule_scan(), which handles an AJAX action to save the cookie scan schedule, lacks proper capability checks and nonce verification.

As a result, authenticated users with Subscriber-level access or higher can modify the plugin's cookie scan schedule configuration, which is stored in the gdpr_scan_schedule_data option. This configuration change is supposed to be restricted to users with the manage_options capability, typically administrators.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users with low-level access (Subscriber and above) to modify administrative settings related to the cookie scan schedule in the GDPR Cookie Consent plugin.

While it does not allow direct data disclosure or deletion, unauthorized modification of the cookie scan schedule could disrupt the proper functioning of cookie compliance scanning, potentially leading to inaccurate or incomplete cookie consent management.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers with Subscriber-level access and above to modify the GDPR Cookie Consent plugin's cookie scan schedule configuration, which is an administrative function intended to be restricted. This unauthorized modification could potentially undermine the proper functioning of cookie consent management, which is a critical component for compliance with GDPR requirements regarding user consent and data privacy.

However, the CVE description and provided resources do not explicitly state the direct impact on compliance with GDPR, HIPAA, or other regulations.

Useful 0 Not Useful 0