[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fthn-g_b-Z7rlayMXoMCMP0Ur_Fxw5kE74HZVSCsKAfY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-12955","cookie-banner-for-gdpr-ccpa-missing-authorization-to-authenticated-subscriber-scan-schedule-modification-via-gccsavesche","Cookie Banner for GDPR \u002F CCPA \u003C= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action","The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the gdpr_cookie_consent_ajax_save_schedule_scan() function (the wp_ajax_gcc_save_schedule_scan AJAX action) in versions up to, and including, 4.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's cookie scan schedule configuration stored in the gdpr_scan_schedule_data option, which is an administrative function intended to be limited to users with the manage_options capability.","gdpr-cookie-consent",null,"\u003C=4.3.6","4.3.7","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-09 19:07:32","2026-07-10 07:48:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fddee10e0-093c-47a3-8aa9-946d6d21e1b2?source=api-prod",1,[22,23,24,25,26,27,28,29],"README.txt","admin\u002Fclass-gdpr-cookie-consent-admin.php","admin\u002Fcss\u002Fgdpr-cookie-consent-admin.css","admin\u002Fcss\u002Fgdpr-cookie-consent-admin.min.css","admin\u002Fjs\u002Fgdpr-cookie-consent-admin-revamp.js","admin\u002Fjs\u002Fvue\u002Fgdpr-cookie-consent-admin-main.js","admin\u002Fmodules\u002Fcookie-scanner\u002Fclass-wpl-cookie-consent-cookie-scanner.php","admin\u002Fmodules\u002Fcookie-scanner\u002Fclasses\u002Fclass-wpl-cookie-consent-cookie-scanner-ajax.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-12955\n\n## 1. Vulnerability Summary\nThe **Cookie Banner for GDPR \u002F CCPA** plugin (versions \u003C= 4.3.6) is vulnerable to an **Authorization Bypass** via the `gcc_save_schedule_scan` AJAX action. The function `gdpr_cookie_consent_ajax_save_schedule_scan()` (the handler for this action) fails to implement capability checks (`current_user_can`) and nonce verification (`check_ajax_referer`). This allows any authenticated user, including those with **Subscriber** privileges, to modify the administrative cookie scan schedule configuration stored in the `gdpr_scan_schedule_data` option.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **HTTP Method:** `POST`\n*   **Action:** `gcc_save_schedule_scan`\n*   **Payload Parameter:** `schedule_data` (inferred) or direct POST mapping.\n*   **Authentication:** Authenticated (Subscriber-level or higher).\n*   **Preconditions:** The plugin must be active. A Subscriber user account is required to access `admin-ajax.php`.\n\n## 3. Code Flow\n1.  The plugin registers the AJAX action: `add_action( 'wp_ajax_gcc_save_schedule_scan', 'gdpr_cookie_consent_ajax_save_schedule_scan' );`.\n2.  A Subscriber user sends a POST request to `admin-ajax.php` with `action=gcc_save_schedule_scan`.\n3.  WordPress core dispatches the request to the handler function.\n4.  The handler lacks a check for `manage_options` capability.\n5.  The handler lacks a call to `check_ajax_referer` or `wp_verify_nonce`.\n6.  The handler extracts data from `$_POST` and passes it to `update_option( 'gdpr_scan_schedule_data', ... )`.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability report, this specific endpoint **lacks nonce verification entirely**. \n\nHowever, if verification was partially implemented or the agent needs to verify the presence of nonces for other scanner actions, the following strategy applies:\n1.  **Identify Localization:** The plugin localizes data via `gdpr_localize_data` (found in `admin\u002Fjs\u002Fgdpr-cookie-consent-admin-revamp.js`).\n2.  **Navigate to Admin:** Use `browser_navigate` to `\u002Fwp-admin\u002Fadmin.php?page=gdpr-cookie-consent-settings`.\n3.  **Extract via JS:** Use `browser_eval(\"window.gdpr_localize_data\")` to find the relevant security token.\n4.  **Note:** Since the vulnerability explicitly states \"missing nonce verification\", requests should succeed without any `security` or `_wpnonce` parameters.\n\n## 5. Exploitation Strategy\nThe goal is to modify the `gdpr_scan_schedule_data` option to demonstrate unauthorized control over administrative settings.\n\n### Step 1: Login\nAuthenticate as a Subscriber user using the provided credentials.\n\n### Step 2: Send Exploit Payload\nUse the `http_request` tool to send the unauthorized update.\n\n**Request Details:**\n*   **URL:** `http:\u002F\u002F[target]\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** `POST`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```text\n    action=gcc_save_schedule_scan&schedule_data[enable_scan]=true&schedule_data[scan_interval]=daily&schedule_data[scan_time]=03:15\n    ```\n    *(Note: If `schedule_data` as an array fails, try flat parameters: `action=gcc_save_schedule_scan&enable_scan=true&scan_interval=daily`)*\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure `gdpr-cookie-consent` version 4.3.6 is installed.\n2.  **Create User:** \n    ```bash\n    wp user create attacker attacker@example.com --role=subscriber --user_pass=password123\n    ```\n3.  **Check Initial State:**\n    ```bash\n    wp option get gdpr_scan_schedule_data\n    ```\n\n## 7. Expected Results\n*   **HTTP Response:** The server should return a successful status (likely `200 OK`) and a body indicating success (e.g., `1`, `{\"success\":true}`, or `{\"status\":\"success\"}`).\n*   **Data Impact:** The `gdpr_scan_schedule_data` option in the WordPress database will reflect the values sent by the Subscriber.\n\n## 8. Verification Steps\nAfter the `http_request`, verify the change using WP-CLI:\n```bash\nwp option get gdpr_scan_schedule_data\n```\nThe output should show the `daily` interval and `03:15` time (or whichever values were used in the payload).\n\n## 9. Alternative Approaches\nIf the `schedule_data` parameter name is incorrect:\n1.  **Inspection:** Navigate to the \"Cookie Scanner\" tab in the admin UI using the browser tool.\n2.  **DOM Analysis:** Use `browser_eval` to inspect the \"Save\" button in the schedule settings section:\n    ```javascript\n    \u002F\u002F Check for form fields or AJAX calls in the scanner module\n    Array.from(document.querySelectorAll('input, select')).filter(i => i.name.includes('scan'))\n    ```\n3.  **Parameter Refinement:** Adjust the payload based on the found input `name` attributes.","gemini-3-flash-preview","2026-07-15 11:15:38","2026-07-15 11:16:28",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.3.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgdpr-cookie-consent\u002Ftags\u002F4.3.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgdpr-cookie-consent.4.3.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgdpr-cookie-consent\u002Ftags\u002F4.3.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgdpr-cookie-consent.4.3.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgdpr-cookie-consent\u002Ftags"]