The Lightweight Cookie Notice plugin contains a hardcoded constant, W3TC_DYNAMIC_SECURITY, that matches the security key used by the W3 Total Cache plugin. An unauthenticated attacker who can read the plugin files can learn this key, allowing the attacker to execute arbitrary PHP code when W3 Total Cache is also active on the site. This vulnerability is a classic case of sensitive information exposure that can lead to remote code execution if the conditions are met, exposing the confidentiality, integrity, and availability of the website.

The vulnerability affects all installations of the Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress with versions up to and including 1.19. The issue is present in any environment where W3 Total Cache is also installed, as the security key is shared between the two plugins.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score is < 1%, indicating a very low probability of exploitation, though the attack requires both plugins to be present and the constant to be known. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request that allows the attacker to obtain the hardened constant value, possibly through directory traversal or by directly accessing the plugin file.