A/B Testing Configuration Vulnerability in WPLP Cookie Consent Plugin by WordPress
CVE-2026-82185
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 September 2026
Badges
What is CVE-2026-82185?
The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is vulnerable due to the lack of capability and nonce checks in its A/B testing actions. This oversight allows authenticated users, including those with minimal privileges like subscribers, to alter the cookie banner settings that are displayed to all site visitors. Furthermore, this vulnerability enables them to irreversibly reset A/B test results, undermining the site's analytics and testing integrity. Implementing proper authentication checks is essential to safeguard against such unauthorized modifications.
Affected Version(s)
WPLP Cookie Consent 3.6.5 < 4.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.