What is the CVSS score of CVE-2026-12920?

CVE-2026-12920 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WPLP Cookie Consent CVE-2026-12920

EUVD-2026-41469 MEDIUM

SQL Injection (CWE-89)

2026-07-03 Wordfence

GHSA-64rj-8mhx-6c97

WordPress SQLi Wplegalpages Wordpress Plugin Cookie Banner For Gdpr Ccpa Wplp Cookie Consent

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Admin panel is network-accessible (AV:N), but PR:H reflects mandatory administrator credentials; SQL injection yields database reads only, so I:N and A:N.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 01:58 vuln.today

CVE Published

Jul 03, 2026 - 01:28 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 4.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (all versions up to and including 4.3.5) enables authenticated administrators to append arbitrary SQL clauses to existing queries via the unescaped 's' search parameter in the admin data-request table interface. The vulnerable code spans at least four distinct query paths in class-wpl-data-req-table.php (lines 322, 377, 492, and 513), each failing to sanitize or properly prepare user-supplied input before use in database queries. No public exploit or CISA KEV listing has been identified at time of analysis; the high privilege requirement (WordPress administrator) substantially constrains real-world attack surface.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically the failure to use WordPress's wpdb->prepare() mechanism or equivalent escaping before interpolating the 's' parameter into SQL queries. The affected component is the admin-facing GDPR data-request management module of the gdpr-cookie-consent plugin (CPE: cpe:2.3:a:wplegalpages:cookie_banner_for_gdpr_/_ccpa_-_wplp_cookie_consent:*:*:*:*:*:*:*:*), developed by WP Legal Pages. The WordPress plugin architecture exposes this functionality via the WP Admin dashboard, and the vulnerable parameter appears in a WP_List_Table-style search/filter field. The multi-site occurrence of the flaw across lines 322, 377, 492, and 513 of class-wpl-data-req-table.php suggests the insecure pattern was replicated across several admin table query methods rather than isolated to a single code path.

RemediationAI

A code fix was committed to the plugin's WordPress Subversion repository under changeset 3593450 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3593450%40gdpr-cookie-consent&new=3593450%40gdpr-cookie-consent); however, the exact patched release version is not independently confirmed from available data - administrators should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/572bfa82-92f5-4801-8710-0626ca563a6c and the WordPress plugin directory to identify the first released version incorporating this changeset, then upgrade immediately. As a compensating control prior to patching, enforce multi-factor authentication on all WordPress administrator accounts and restrict administrator-role assignment to the minimum necessary personnel, since PR:H means credential compromise is the sole prerequisite for exploitation. Temporary deactivation of the plugin's data-request admin table feature (if configurable) would eliminate the vulnerable endpoint entirely, at the cost of losing GDPR data-subject request management functionality.