Description
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2026-07-10
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin contains a generic SQL injection flaw in the ‘scan_id’ parameter. The user‑supplied value is insufficiently escaped and the existing SQL query is not prepared, allowing an authenticated user with administrator privileges or higher to append arbitrary SQL statements. This can expose or modify sensitive data stored in the WordPress database, as the vulnerability is classified as CWE‑89.

Affected Systems

All installations of the WordPress plugin Cookie Banner for GDPR / CCPA – WPLP Cookie Consent that are version 4.3.6 or earlier are affected. This includes every site that has not upgraded beyond 4.3.6.

Risk and Exploitability

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacks require authenticated administrator access; an attacker who can log in with privileged credentials can execute the injected SQL to read or alter database contents, potentially compromising confidentiality and integrity.

Generated by OpenCVE AI on July 29, 2026 at 11:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the WPLP Cookie Consent plugin to the latest version that fixes the injection flaw.
  • If an update is not immediately available, modify the plugin’s database code to sanitize the ‘scan_id’ parameter or apply wpdb->prepare to the query; this prevents arbitrary SQL from being appended.
  • Enforce strong administrator passwords and enable multi‑factor authentication to reduce the risk that an attacker can gain the necessary credentials to exploit the flaw.

Generated by OpenCVE AI on July 29, 2026 at 11:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wplegalpages
Wplegalpages cookie Banner For Gdpr / Ccpa – Wplp Cookie Consent
Vendors & Products Wordpress
Wordpress wordpress
Wplegalpages
Wplegalpages cookie Banner For Gdpr / Ccpa – Wplp Cookie Consent

Fri, 10 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Description The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Title Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wordpress Wordpress
Wplegalpages Cookie Banner For Gdpr / Ccpa – Wplp Cookie Consent
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-10T11:11:58.683Z

Reserved: 2026-07-02T14:55:53.182Z

Link: CVE-2026-14475

cve-icon Vulnrichment

Updated: 2026-07-10T11:11:46.445Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:15:04Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')