CVE-2026-24604: 
WordPress vulnerability analysis and mitigation

CVE-2026-24604 is a Missing Authorization (Broken Access Control) vulnerability in the Simple GDPR Cookie Compliance WordPress plugin developed by themebeez. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. All versions up to and including 2.0.0 are affected. The vulnerability was published on January 23, 2026, with a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing functionality. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The specific plugin functions or endpoints lacking authorization checks have not been publicly detailed beyond the Patchstack advisory, but the vulnerability class typically involves unprotected AJAX handlers or REST API endpoints that perform privileged operations (Patchstack, NVD).

Successful exploitation results in a low-integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can make unauthorized modifications to data or plugin settings managed by the Simple GDPR Cookie Compliance plugin. This could allow manipulation of cookie consent banners or compliance settings on affected WordPress sites, potentially undermining GDPR compliance posture. The scope is limited to the affected plugin's functionality and does not directly enable lateral movement or sensitive data exfiltration (NVD, Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at approximately 0.009%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, NVD).

Users should update the Simple GDPR Cookie Compliance plugin to a version beyond 2.0.0 that addresses the missing authorization checks. If no patched version is yet available from themebeez, site administrators should consider temporarily deactivating the plugin until a fix is released. Implementing a Web Application Firewall (WAF) with rules targeting unauthorized access to WordPress plugin endpoints can serve as an interim mitigation (Patchstack).