CVE-2026-17587

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify plugin settings including missing_cookie_shield, cookie_shield_running, cmode_v2_js_on_error, cmode_v2_js_error_code, and cmode_v2_js_error_motivation stored in the plugin's settings key.

• CWE-862

• https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/frontend/my-agile-privacy-frontend.php#L2205
• https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/frontend/my-agile-privacy-frontend.php#L3391
• https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/frontend/my-agile-privacy-frontend.php#L3509
• https://plugins.trac.wordpress.org/browser/myagileprivacy/tags/3.3.6/includes/my-agile-privacy-class.php#L460
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3650495%40myagileprivacy&new=3650495%40myagileprivacy
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7956fe49-b3b3-4f8d-8e90-8719bc2fa0fa?source=cve

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-17580The Advanced Views – Display Custom Fields (ACF, Pods, MetaB…6.5
• CVE-2026-17581The WCPOS – Point of Sale (POS) plugin for WooCommerce plugi…7.2
• CVE-2026-17582The Slider Hero plugin for WordPress is vulnerable to second…4.9
• CVE-2026-17583The affected Thermo Fisher Applied Biosystems Genetic Analy…8.4
• CVE-2026-17585The Royal Addons for Elementor – Addons and Templates Kit fo…5.3
• CVE-2026-17586The VK All in One Expansion Unit plugin for WordPress is vul…6.4
• CVE-2026-17589The Shopping Cart & eCommerce Store plugin for WordPress is …4.9
• CVE-2026-1759Improper handling of insufficient permissions or privileges …6.5
• CVE-2026-17590Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-17592Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-17593An account holding the nexus:settings:update permission in N…7.2
• CVE-2026-17594Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x cont…4.9