The Cookie Consent WordPress plugin fails to enforce the intended administrator‑only capability check on the REST route used to store its geolocation service license key. The route relaxes to an authentication‑only gate, so any authenticated user, such as a subscriber, can overwrite the stored key. This tampering can disable the plugin’s geolocation‑based consent banner, causing the banner to stop appearing or to target users incorrectly, effectively breaking the site’s compliance mechanism.

The vulnerability affects the Cookie Consent WordPress plugin prior to version 0.0.10. Any site running a version earlier than 0.0.10 of this plugin is susceptible.

The exploitation requires only authentication, not elevated privileges, making the attack vector low‑threshold for users who normally have limited access. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low probability of exploitation but no known active attacks. With a CVSS score of 4.3, the vulnerability is classified as moderate severity, and the potential for service disruption and compliance failure provides a moderate risk assessment for sites with larger user bases.