Cookie Consent Plugin Vulnerability in WPLP by WordPress
CVE-2026-85132
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 September 2026
Badges
What is CVE-2026-85132?
The WPLP Cookie Consent plugin for WordPress, prior to version 4.4.2, is susceptible to an improper authentication vulnerability. This flaw stems from the inadequate implementation of nonce and capability checks in a specific AJAX action related to its cookie scanner functionality. As a result, any authenticated user, including those with lower privilege levels such as subscribers, can access sensitive information including the automated scan schedule configured by the administrator. This exposure poses a significant risk, allowing unauthorized users to potentially monitor configuration settings, which could lead to further exploitation.
Affected Version(s)
WPLP Cookie Consent 4.0.2 < 4.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.