Lightweight Cookie Notice CVE-2026-12272

The confidentiality leak itself requires no special conditions - a remote unauthenticated attacker can rely on the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value in all versions up to and including 1.19. However, escalation to arbitrary PHP code injection is strictly gated: the W3 Total Cache plugin must ALSO be installed on the same site and its mfunc dynamic-content feature must be active to process signed mfunc directives. On sites without W3 Total Cache, or without mfunc in use, impact is limited to disclosure of a security key with no direct code-execution path. The limiting factor is therefore the co-presence and configuration of a second, separate plugin (W3 Total Cache), not any authentication or user interaction.

The input signals point to a moderate, conditional risk rather than a widespread emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) yields a 5.3 Medium score reflecting ONLY the low-impact confidentiality leak (C:L/I:N/A:N) - i.e. the exposure of the hardcoded W3TC_DYNAMIC_SECURITY value - not the far more serious PHP code injection that becomes possible downstream. That escalation is explicitly conditional: the description says arbitrary PHP code injection 'may' occur only 'when W3 Total Cache is installed' and its mfunc feature is in use, so the headline 5.3 understates worst-case impact while the worst case itself is gated by a second-plugin prerequisite. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so exploitation probability and automatability cannot be quantified from the data given - there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a credible defense-in-depth weakness for sites running both this plugin and W3 Total Cache, but absent EPSS/KEV/POC signals it should be treated as a patch-promptly item, not a drop-everything incident. Note the conflict to verify: the unauthenticated network vector applies to disclosing the key, but weaponizing it into RCE depends on a separate product (W3 Total Cache) and its configuration, which the base CVSS does not capture.

A remote, unauthenticated attacker targets a WordPress site running Lightweight Cookie Notice (≤1.19) alongside W3 Total Cache. Because W3TC_DYNAMIC_SECURITY is hardcoded to a publicly known value, the attacker already knows the W3 Total Cache mfunc security key and can craft requests containing mfunc directives that, if W3TC processes them, execute attacker-supplied PHP on the server. No public exploit code was identified in the provided data, and the RCE path depends on W3 Total Cache being installed and processing mfunc content.