The vulnerability arises because the Cookie Consent WordPress plugin before version 0.0.10 fails to enforce an administrator‑only capability check on its consent‑settings REST routes. This allows any authenticated user, such as a subscriber, to alter the plugin’s consent settings and, on sites using the vendor’s paid plan, read stored visitor consent logs. The flaw enables unauthorized configuration changes and potential privacy disclosure, classified under CWE‑284 Improper Access Control.

Any WordPress site running the Cookie Consent plugin version earlier than 0.0.10, particularly those subscribed to the vendor’s paid plan.

The exploit requires only an authenticated user account; it does not involve arbitrary code execution. Although no CVSS score is provided and the EPSS is not available, the vulnerability remains of moderate concern because it permits attackers with legitimate subscriber credentials to modify site settings and access sensitive logs. The lack of public exploitation data suggests that, while the attack surface exists, widespread use may be limited.