Wplp Cookie Consent Cookie Banner Consent Management For Gdpr Ccpa Google Consent Mode
CVE-2026-15136
|
EUVD-2026-49694
MEDIUM
GHSA-55gj-j5m5-7h32
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
More in Wplp Cookie Consent Cookie Banner Consent Management For Gdpr Ccpa Google Consent Mode
View allUnauthenticated arbitrary file upload in the WPLP Cookie Consent (GDPR/CCPA cookie banner) plugin for WordPress, version
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persiste
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today