Threat Investigation
Request a demo

CVE-2026-18046

Medium

Description

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.

SeverityMedium
CVSS4.3
Exploit probability—
ProductCookie Consent
PublishedAug 12, 2026
First seenAug 12, 2026
Weakness typeCWE-863Incorrect authorization

How to fix

Update
  • Cookie Consent0.0.10 or later

Affected products

ProductAffected versionsFixed in
Cookie Consent0.0.9 ≤ v < 0.0.100.0.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.