WP GDPR Cookie Consent CVE-2026-8977

Exploitation requires the attacker to hold a valid WordPress account with at minimum subscriber-level privileges (CVSS PR:L confirmed). The WP GDPR Cookie Consent plugin must be installed and active on the target site running version 1.0.0 or earlier. The plugin's AJAX handler is registered globally for authenticated users, so no specific plugin configuration or non-default setting beyond simple installation is required. Exploitation is NOT possible by unauthenticated users - a valid WordPress session token is required, which limits risk on sites that do not allow open registration or that tightly control account creation. The injected payload persists in stored configuration (gdprConfig), meaning a single successful write request causes ongoing impact for all future site visitors until the payload is removed. There is no user interaction required on the attacker's side (UI:N), but victim users must visit an affected page for the XSS payload to execute against them.

The CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N is well-calibrated for this vulnerability. The network attack vector and low complexity confirm remote exploitation with no special conditions beyond a subscriber account. The Changed Scope is the most significant risk multiplier: a single compromised or malicious subscriber can inject scripts that execute for every visitor to affected pages, enabling session hijacking, credential phishing, or malvertising at scale. PR:L (low privileges required) means any registered user - including self-registered subscribers on open-registration WordPress sites - can exploit this, substantially widening the attacker pool compared to admin-only issues. No EPSS score was provided in the input data, so quantitative exploitation probability cannot be stated. No CISA KEV listing exists and no public POC has been identified, suggesting this has not yet attracted mass exploitation. However, the low entry barrier (subscriber account) and the architectural nature of the flaw (three cooperating missing controls, not a single off-by-one) means it is unlikely to be a false positive. Priority should be elevated on any WordPress site with open user registration or untrusted subscriber accounts.

An attacker registers a free subscriber account on a WordPress site running WP GDPR Cookie Consent 1.0.0 with open user registration enabled. The attacker sends a crafted POST request to wp-admin/admin-ajax.php with action=ninja_gdpr_ajax_actions and injects a malicious JavaScript payload into a gdprConfig field; because handleAjaxCalls() performs no capability or nonce check, the payload is accepted and stored. Every subsequent visitor to the site triggers generateCSS() on wp_head, which renders the injected payload inside a <style> block, and the browser executes the attacker's script - enabling session cookie theft or redirects to phishing pages at scale. No public POC has been identified at time of analysis.