What is the CVSS score of EUVD-2026-27329?

EUVD-2026-27329 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WeePie Cookie Allow are affected by EUVD-2026-27329?

CVE-2026-4304 is a high-severity SQL injection vulnerability in the WeePie Cookie Allow WordPress plugin (versions ≤3.4.11) that allows unauthenticated attackers to extract sensitive database…

How to fix or mitigate EUVD-2026-27329?

Within 24 hours: Identify all WordPress instances using WeePie Cookie Allow plugin ≤3.4.11 via automated inventory scan. Within 7 days: Immediately disable or remove the vulnerable plugin from all production environments, and conduct database audit for unauthorized access indicators. Within 30 days: Implement a Web Application Firewall (WAF) rule blocking SQL injection patterns in the 'consent' parameter as interim control pending vendor patch availability; consider plugin replacement with maintained alternatives.

WeePie Cookie Allow EUVD-2026-27329

| CVE-2026-4304 HIGH

SQL Injection (CWE-89)

2026-05-05 Wordfence

GHSA-3p4f-gq85-7pv7

SQLi WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 14:30 vuln.today

DescriptionCVE.org

The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to, and including, 3.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in WeePie Cookie Allow plugin for WordPress versions ≤3.4.11 allows remote unauthenticated attackers to extract sensitive database contents via the 'consent' parameter. The vulnerability stems from insufficient SQL query preparation and parameter escaping, enabling attackers to append malicious SQL queries to existing database operations. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation at time of analysis.

Technical ContextAI

WeePie Cookie Allow is a premium WordPress plugin for GDPR cookie consent management, sold via CodeCanyon. The vulnerability exists in CWE-89 (SQL Injection) where the 'consent' parameter lacks proper sanitization before inclusion in SQL queries. WordPress typically uses wpdb prepared statements ($wpdb->prepare()) to prevent SQL injection; this plugin appears to concatenate user input directly into SQL strings or use inadequate escaping functions. The affected component likely handles user consent preferences or cookie banner interactions, processing untrusted input from web requests without validation. All versions through 3.4.11 are confirmed vulnerable per CPE cpe:2.3:a:weepie:weepie_cookie_allow:*:*:*:*:*:*:*:*, indicating a long-standing code defect across the product line.

RemediationAI

Check vendor changelog at https://weepie-plugins.com/changelog-weepie-cookie-allow-plugin/ for patched version release; upgrade immediately when available (no fixed version confirmed at time of analysis). Until patch deployment, implement compensating controls: (1) Deploy web application firewall (WAF) rules to block SQL injection patterns in 'consent' parameter requests - may cause false positives blocking legitimate consent submissions, requiring tuning; (2) Review database access logs for suspicious queries containing UNION, SELECT, OR, or encoded SQL keywords originating from plugin endpoints; (3) If cookie consent is non-critical to site operation, temporarily disable the plugin and implement basic cookie notice via theme code - loses GDPR consent management features; (4) Restrict database user permissions for WordPress to SELECT/INSERT/UPDATE/DELETE only, revoking FILE, PROCESS, SUPER privileges to limit data exfiltration via OUTFILE or information_schema access - may break backup plugins or import/export tools. Each mitigation trades functionality for security; patching is the only complete solution.