WordPress Plugin Vulnerabilities
Lightweight Cookie Notice < 1.20 - Unauthenticated Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
Description
The plugin is vulnerable to Sensitive Information Exposure due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.
Affects Plugins
Fixed in 1.20 References
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
wesley (wcraft)
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-10-15 (about 2 days ago)
Added
2026-10-16 (about 1 day ago)
Last Updated
2026-10-16 (about 1 day ago)
