WPLP Cookie Consent CVE-2026-75865

No authentication required - the WPLP connector REST endpoints contain an authorization bypass, and saas_upload_logo() performs no file-type validation, so exploitation works against default installations of vulnerable versions (≤4.4.1) reachable over the network. The main practical limiter is that full remote code execution ('may make RCE possible') depends on the target web server permitting execution of PHP within the uploads directory; on hardened servers that block PHP execution in wp-content/uploads, the attacker still gets arbitrary file write but not direct code execution. The vulnerable plugin must be installed and active.

All available signals point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with full impact, consistent with the description's claim of unauthenticated arbitrary upload leading to possible RCE. No EPSS score, KEV listing, or public POC was provided, so exploitation probability cannot be quantified and there is no confirmed in-the-wild activity - the 9.8 reflects potential severity, not observed exploitation. Web-facing WordPress plugins with unauthenticated upload bugs are historically attractive to opportunistic mass-scanning botnets, so the practical risk of exploitation rising is high once details/patch diffs are public (the fixing changeset is already published), even though it is 'no public exploit identified' today. Note the RCE outcome is qualified as 'may make remote code execution possible' - file upload is confirmed, full RCE depends on server configuration allowing execution of uploaded content.

An unauthenticated attacker sends a crafted HTTP request directly to the WPLP connector REST endpoint, bypassing the missing authorization check, and invokes the logo-upload routine to POST a malicious PHP file that passes because no file-type validation occurs. The attacker then requests the uploaded file's URL under wp-content/uploads to execute it, gaining code execution in the site's context. Low attack complexity and no authentication or user interaction make this readily automatable by mass scanners; no public POC was provided at time of analysis.