CVE-2026-85131
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records. This allows attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Risk Assessment
The organization is exposed to unauthorized deletion of content (posts and pages) by an admin, which could lead to data loss and website disruption.
Recommendation
It is recommended to update the WPLP Cookie Consent plugin to version 4.4.4 or later, which adds proper CSRF and capability checks and restricts bulk actions to its own records.
Other vulnerabilities in WPLP Cookie Consent
See all- CVE-2026-75865Critical
The WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints. This allows unauthenticated attackers to upload arbitrary files on the server, potentially leading to remote code execution.
- CVE-2026-14989High
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress up to version 4.4.1 is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-82185Medium
The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
- CVE-2026-82184Medium
The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.
- CVE-2026-82186Medium
The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.
- CVE-2026-14475Medium
The Cookie Banner for GDPR/CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL injection via the 'scan_id' parameter in all versions up to and including 4.3.6 due to insufficient escaping and lack of query preparation. This allows authenticated attackers with administrator-level access or higher to append additional SQL queries to existing ones.
- CVE-2026-12920Medium
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL injection via the 's' parameter in all versions up to and including 4.3.5. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with administrator-level access and above can append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS