Security Alert Summary
The My Agile Privacy – CMP, Cookie Consent & Privacy Tools plugin for WordPress contains an authorization bypass in all versions up to and including 3.3.6. Insufficient verification of user authorization allows unauthenticated actors to modify specific plugin settings, which can change the plugin’s runtime behavior.
CVE Details
- CVE ID: CVE-2026-17587
- Affected component: My Agile Privacy – CMP, Cookie Consent & Privacy Tools (plugin)
- Affected versions: All versions up to and including 3.3.6
- Published: August 25, 2026 at 12:16:21 PM
- Last modified: August 25, 2026 at 12:16:21 PM
- CVSS v3.1 base score: 5.3
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction:
- Authentication required: NONE
- Privileges required: NONE
- User interaction required: NONE
- Primary impact (C / I / A): Confidentiality: NONE, Integrity: LOW, Availability: NONE
- CWE / weakness: CWE-862 (Authorization Bypass)
Technical Details
This issue is an authorization bypass where the plugin fails to properly verify that a requester is authorized to perform certain configuration actions. The vulnerability allows unauthenticated attackers to modify plugin settings stored in the plugin settings key. The CVE report specifically lists settings that can be modified, including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation.
Public references point to plugin frontend and include files in the plugin repository (for example, frontend/my-agile-privacy-frontend.php and includes/my-agile-privacy-class.php) where the relevant checks appear to be missing or insufficient. Because no authentication or privilege checks are required (per the CVSS data), an attacker can invoke the affected functionality remotely without interacting with a logged-in account.
Impact is confined to integrity of plugin configuration: an attacker can change settings that control cookie shield and related consent behavior. The vulnerability does not indicate direct confidentiality or availability loss according to the provided CVSS metrics.
How This Could Impact Your Website
On a site with multiple WordPress users, an unauthenticated attacker altering cookie consent or shield settings could cause consent dialogs or cookie handling to behave differently for site visitors and staff. For example, a site owner, an internal editor, and an external contractor could see inconsistent consent behavior, which may confuse users or administrators and could be leveraged to increase the risk of targeted phishing or social engineering.
While the CVSS data shows no direct confidentiality impact, changing consent or shield settings can still affect user experience and trust. If you re not sure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege accounts that exist for convenience.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and plugin settings for unusual behavior or unexpected configuration changes.
If you d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/frontend/my-agile-privacy-frontend.php#L2205
- https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/frontend/my-agile-privacy-frontend.php#L3391
- https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/frontend/my-agile-privacy-frontend.php#L3509
- https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/includes/my-agile-privacy-class.php#L460
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3650495%40myagileprivacy&new=3650495%40myagileprivacy
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7956fe49-b3b3-4f8d-8e90-8719bc2fa0fa?source=cve
