WordPress Plugin Vulnerabilities

WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

Description

The plugin does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.

Proof of Concept

Affects Plugins

Plugin icon
gdpr-cookie-consent
Fixed in 4.4.2

References

CVE
CVE-2026-82184

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Alex Spataru
Submitter
Alex Spataru
Submitter website
https://alexspataru.com
Verified
Yes
WPVDB ID
54f2da44-84c2-4c56-88f3-615ae4054ecb

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2024-10-10
Title
Hunk Companion < 1.8.5 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
Published
2023-09-06
Title
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization via export_settings
Published
2025-12-31
Title
Walker for Elementor <= 1.1.6 - Missing Authorization
Published
2026-08-14
Title
WP Sort Order <= 1.3.5 - Missing Authorization
Published
2026-03-13
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license