CVE-2026-17587
Received Received - Intake

Authorization Bypass in My Agile Privacy WordPress Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: Wordfence

Description
The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify plugin settings including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation stored in the plugin's settings key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-17587
EUVD
EUVD-2026-65461

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
my_agile_privacy cmp_cookie_consent_and_privacy_tools to 3.3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The My Agile Privacy – CMP plugin for WordPress has an authorization bypass vulnerability in versions up to 3.3.6. This allows unauthenticated attackers to modify plugin settings without proper verification of user permissions.

Detection Guidance

Check WordPress plugin versions for My Agile Privacy – CMP, Cookie Consent & Privacy Tools. If version is up to 3.3.6, it is vulnerable. Look for unauthorized changes to plugin settings like missing_cookie_shield or cookie_shield_running.

Impact Analysis

Unauthenticated attackers could change plugin settings, potentially altering privacy tool configurations or disabling security features. This may expose users to privacy risks or non-compliance with intended privacy policies.

Compliance Impact

This vulnerability could lead to improper handling of user consent or privacy settings, potentially violating GDPR or HIPAA requirements for data protection and user consent management.

Mitigation Strategies

Update the plugin to the latest version beyond 3.3.6 immediately. If update is unavailable, disable and remove the plugin until a patch is released. Review plugin settings for unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart