The vulnerability exists in the GDPR Cookie Consent WordPress plugin where the ajax handler gdpr_cookie_consent_ajax_save_schedule_scan lacks proper capability and nonce checks. Because the request requires only Subscriber‑level access, any authenticated user with that role can invoke the vulnerable wp_ajax_gcc_save_schedule_scan action and alter the gdpr_scan_schedule_data option. This option controls the cookie‑scan schedule, normally a setting reserved for users with the manage_options capability. The flaw is classified as CWE‑862 and is rated with a CVSS score of 4.3.

WordPress installations using the WPLP Cookie Consent plugin (Cookie Banner for GDPR / CCPA) versions through 4.3.6 are affected. The problem has been documented in the 4.3.5 tables and persists up to the 4.3.6 release.

The CVSS score indicates moderate severity, and the EPSS score of less than 1 % signals that exploitation is currently unlikely. The vulnerability requires an authenticated user running the site with at least Subscriber permission and is accessed through an internal AJAX call. It is not listed in CISA’s KEV catalog at this time.