CVE-2026-82970

CriticalCVSS 10.0

Published: 31/08/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Summary

The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (part of WP Legal Pages) has an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files. This issue affects versions from n/a through 4.4.1.

Risk Assessment

An attacker may upload malicious files, potentially leading to code execution on the server or other serious security breaches.

Recommendation

Update the WP Cookie Notice plugin to the latest available version that includes a fix. If an update is not available, consider temporarily disabling the plugin.

Other vulnerabilities in WP Cookie Notice

CVE-2026-73359Medium
Cross Site Scripting (XSS) vulnerability in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions up to 4.3.9. The attack requires subscriber-level privileges.

Original NVD description (English source)

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.