EUVD-2026-80194
GHSA-px42-w9w7-vmf7
Lifecycle Timeline
2DescriptionCVE.org
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Analysis
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wplp Cookie Consent
View allMissing authorization controls in WPLP Cookie Consent WordPress plugin before 4.4.2 allow any subscriber-level authentic
Unauthenticated arbitrary option overwrite in WPLP Cookie Consent WordPress plugin before 4.4.2 lets any remote visitor
Missing authorization on a cookie-scanner AJAX endpoint in the WPLP Cookie Consent WordPress plugin before 4.4.2 allows
Missing authorization in WPLP Cookie Consent WordPress plugin (versions 3.6.5 through before 4.4.2) allows any authentic
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated adminis
Share
External POC / Exploit Code
Leaving vuln.today