WPLP Cookie Consent CVE-2026-14475

Exploitation requires an authenticated WordPress session with administrator-level privileges (role: administrator or above). The vulnerable code paths reside exclusively in the admin cookie scanner module, meaning the attacker must have access to wp-admin AJAX endpoints restricted to administrator roles. The plugin must be installed and active on the target WordPress installation. No special server configuration or non-default WordPress settings are required beyond the plugin being present. Limiting factors: the PR:H requirement means unauthenticated or subscriber/editor-level users cannot trigger this vulnerability; exploitation is entirely blocked without admin credentials. The attack is also read-only - the CVSS vector confirms I:N, so no data modification or site takeover is achievable through this flaw alone.

The CVSS 3.1 base score of 4.9 (Medium) accurately reflects the constrained real-world risk. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates network accessibility and no complexity, but anchors risk firmly on the PR:H requirement - exploitation demands a fully authenticated WordPress administrator session. In practice, an attacker who already holds admin credentials can cause far more damage through native WordPress functionality, significantly reducing the marginal impact of this SQL injection. Impact is confidentiality-only (C:H, I:N, A:N), meaning an attacker can read database contents but cannot modify data or disrupt availability via this vector alone. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative and no POC has been identified, consistent with the high privilege bar. The primary realistic threat scenario is a rogue or compromised administrator account, or a privilege escalation chain where this SQLi is a secondary step to harvest credentials. This is not a fire-drill priority for most organizations but warrants patching to close the data-extraction path.

An attacker with a compromised or rogue WordPress administrator account authenticates to the wp-admin panel, then submits a crafted AJAX request to the cookie scanner module with a malformed 'scan_id' value containing appended SQL syntax (e.g., UNION SELECT payloads). The unsanitized parameter is interpolated directly into the running query, allowing the attacker to retrieve arbitrary table contents - including WordPress user hashes, plugin configuration, or stored consent records - from the underlying MySQL database. No public exploit code has been identified, but the vulnerability class (unsanitized AJAX parameter in admin context) is well-understood and straightforward to exploit manually.