EUVD-2026-70909
GHSA-f3xc-8q46-qff6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Administrator credentials required (PR:H); S:C reflects potential cross-schema read; read-only SQLi yields C:L with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.
AnalysisAI
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid WordPress administrator credentials (PR:H per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) accurately reflects the constrained attack surface: exploitation requires valid WordPress administrator credentials, which substantially narrows the attacker pool to insiders or accounts compromised via separate means such as phishing or credential stuffing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade WPLP Cookie Consent to version 4.4.2 or later, which patches the SQL injection by properly validating the pagination parameter before use in database queries. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wplp Cookie Consent
View allMissing authorization controls in WPLP Cookie Consent WordPress plugin before 4.4.2 allow any subscriber-level authentic
Unauthenticated arbitrary option overwrite in WPLP Cookie Consent WordPress plugin before 4.4.2 lets any remote visitor
Missing authorization on a cookie-scanner AJAX endpoint in the WPLP Cookie Consent WordPress plugin before 4.4.2 allows
Missing authorization in WPLP Cookie Consent WordPress plugin (versions 3.6.5 through before 4.4.2) allows any authentic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today