What is the CVSS score of EUVD-2026-49694?

EUVD-2026-49694 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Wplegalpages EUVD-2026-49694

| CVE-2026-15136 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-28 Wordfence

GHSA-55gj-j5m5-7h32

WordPress CSRF Wplegalpages Wordpress Plugin Wplp Cookie Consent Cookie Banner Consent Management For Gdpr Ccpa Google Consent Mode

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 06:52 vuln.today

CVE Published

Jul 28, 2026 - 05:39 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.