The Cookie Consent WordPress plugin fails to enforce the intended administrator‑only capability check on the REST route used to store its geolocation service license key. The route relaxes to an authentication‑only gate, so any authenticated user, such as a subscriber, can overwrite the stored key. This tampering can disable the plugin’s geolocation‑based consent banner, causing the banner to stop appearing or to target users incorrectly, effectively breaking the site’s compliance mechanism.

The vulnerability affects the Cookie Consent WordPress plugin prior to version 0.0.10. Any site running a version earlier than 0.0.10 of this plugin is susceptible.

The exploitation requires only authentication, not elevated privileges, making the attack vector low‑threshold for users who normally have limited access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Without a CVSS score, the exact severity is unknown, but the potential for service disruption and compliance failure suggests a moderate risk if larger user bases are affected.