WordPress Plugin Vulnerabilities

WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

Description

The plugin does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

Proof of Concept

Affects Plugins

Plugin icon
gdpr-cookie-consent
Fixed in 4.4.2

References

CVE
CVE-2026-82186

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
cyberkareem
Submitter
cyberkareem
Submitter website
https://cyberkareem.com
Verified
Yes
WPVDB ID
a0285ba3-0741-4382-a037-db0ac3fc49d2

Timeline

Publicly Published
2026-09-02 (about 2 days ago)
Added
2026-09-02 (about 1 day ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2005-01-06
Title
WordPress 1.5 & 1.5.1.1 - SQL Injection
Published
2014-08-01
Title
WP Realty - MySQL Time Based Injection
Published
2026-01-05
Title
Form Vibes – Database Manager for Forms < 1.5 - Authenticated (Admin+) SQL Injection
Published
2026-07-06
Title
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection
Published
2025-07-31
Title
Cube Portfolio <= 1.16.8 - Authenticated (Subscriber+) SQL Injection