WPLP Cookie Consent CVE-2026-12920

Exploitation requires a valid WordPress user account holding administrator-level privileges or higher (PR:H per CVSS vector). The attacker must access the admin-side GDPR data-request table interface that the plugin registers within WP Admin, and submit a crafted value for the 's' search/filter parameter. Limiting factors are: (1) administrator-level WordPress authentication is mandatory - unauthenticated users, subscribers, editors, and authors cannot trigger this code path; (2) the target site must have the plugin actively installed and running a version at or below 4.3.5; (3) the impact is read-only data extraction from the database - no data modification, privilege escalation, or service disruption is achievable through this vulnerability alone; (4) the vulnerability is not remotely exploitable without prior credential compromise or legitimate admin access.

The CVSS 3.1 base score of 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the primary tension in this vulnerability: the network-accessible attack surface and high confidentiality impact are substantially offset by the administrator-level privilege requirement (PR:H). In a typical WordPress single-site deployment, an administrator already possesses sufficient access to query the database through built-in tooling (wp-admin, plugin editors, phpMyAdmin if available), making the incremental risk of this SQLi relatively low. Risk is marginally elevated in multisite or managed hosting environments where WordPress administrators may have restricted direct database access. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code has been identified - all signals consistent with a low-urgency finding. The missing EPSS score prevents quantified exploitation probability comparison. The four distinct vulnerable code locations do increase the effective attack surface within the plugin, but exploitation is gated entirely on obtaining valid admin credentials first.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or insider threat - logs into the WP Admin panel and navigates to the GDPR data-request management table provided by the plugin. The attacker appends a SQL UNION SELECT payload to the 's' search parameter (e.g., injecting into the query at lines 322, 377, 492, or 513 of class-wpl-data-req-table.php), extracting sensitive records such as WordPress user hashes, email addresses, or stored PII from the database without triggering visible application errors. No public POC has been identified at time of analysis.