What is the CVSS score of CVE-2026-14475?

CVE-2026-14475 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WPLP Cookie Consent CVE-2026-14475

EUVD-2026-42844 MEDIUM

SQL Injection (CWE-89)

2026-07-10 Wordfence

GHSA-4x73-55x9-5rm2

WordPress SQLi Wplegalpages Wordpress Plugin Cookie Banner For Gdpr Ccpa Wplp Cookie Consent

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Admin panel is network-accessible (AV:N), requires no special conditions (AC:L), demands administrator credentials (PR:H), and enables read-only database extraction with no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 09:21 vuln.today

CVE Published

Jul 10, 2026 - 07:48 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL Injection in the Cookie Banner for GDPR/CCPA - WPLP Cookie Consent WordPress plugin (versions up to and including 4.3.6) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'scan_id' parameter in the cookie scanner module. Exploitation is constrained to administrator-level accounts (PR:H per CVSS vector), making this a privileged read-only database extraction flaw rather than a broad remote attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch commit is referenced in the WordPress plugin repository changeset.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and manifests specifically within the plugin's cookie scanner admin module. Source code references point to three files: class-wpl-cookie-consent-cookie-scanner.php (lines 994 and 1036) and class-wpl-cookie-consent-cookie-scanner-ajax.php (lines 102, 823, and 847) - all under the gdpr-cookie-consent plugin's admin/modules/cookie-scanner path. The 'scan_id' parameter accepted by AJAX handlers in this module is concatenated into SQL queries without adequate escaping or prepared statement use, a classic second-order or direct injection pattern. The affected CPE is cpe:2.3:a:wplegalpages:cookie_banner_for_gdpr_/_ccpa_-_wplp_cookie_consent:*:*:*:*:*:*:*:*, identifying the vendor as WP Legal Pages (wplegalpages). The plugin is a GDPR/CCPA compliance tool, meaning it typically runs on sites that store user consent logs, cookie scan results, and potentially PII-adjacent configuration - making the underlying database a meaningful extraction target.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. A changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3601475%40gdpr-cookie-consent&new=3601475%40gdpr-cookie-consent), indicating the vendor has addressed the issue in trunk, but the exact version number of the released fix was not included in the available data - verify the current plugin version in the WordPress repository before updating. As a compensating control, restrict WordPress administrator account access to the minimum number of trusted users; this directly removes the exploitation prerequisite. Additionally, consider deploying a WAF rule (such as those provided by Wordfence's own firewall) to detect and block SQL injection attempts against wp-admin AJAX endpoints targeting the scan_id parameter. If the cookie scanner module is not actively used, deactivating or removing the plugin eliminates exposure entirely with no functional impact beyond loss of the scanner feature. No workaround for the SQL injection itself exists short of patching.