The vulnerability arises because the Cookie Consent WordPress plugin before version 0.0.10 fails to enforce an administrator‑only capability check on its consent‑settings REST routes. This allows any authenticated user, such as a subscriber, to alter the plugin’s consent settings and, on sites using the vendor’s paid plan, read stored visitor consent logs. The flaw enables unauthorized configuration changes and potential privacy disclosure, classified under CWE‑284 Improper Access Control.

Any WordPress site running the Cookie Consent plugin version earlier than 0.0.10, particularly those subscribed to the vendor’s paid plan.

The exploit requires only an authenticated user account; it does not involve arbitrary code execution. The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% suggests a low exploitation likelihood. The vulnerability allows attackers with legitimate subscriber credentials to modify site settings and access sensitive logs. Because it is not listed in CISA KEV and public exploitation data is lacking, the attack surface remains limited.