WordPress Cookie Banner Plugin Missing Authorization Vulnerability in Uninstall Survey Submission

A vulnerability exists in the Cookie Banner plugin for WordPress, specifically in the Cookiebot CMP by Usercentrics, all versions through 4.4.1. The issue arises from a lack of proper capability checks in the send_uninstall_survey() function, allowing authenticated attackers with Subscriber-level access or higher to submit uninstall surveys on behalf of a website.

Impact

Exploitation of this vulnerability allows for unauthorized submission of uninstall surveys, potentially leading to misleading data collection or manipulation of survey response metrics.

Remediation

Users are advised to update the Cookiebot CMP plugin to version 4.4.2 or later, where this vulnerability has been patched.