The WPLP Cookie Consent plugin for WordPress suffers from a Cross‑Site Request Forgery vulnerability (CWE‑352). A missing or incorrect nonce check in the bulk action handler allows an unauthenticated attacker to craft a request that causes a logged‑in administrator to delete or mark GDPR data‑request entries as resolved. The impact is the permanent removal or alteration of records that may be required for legal compliance, thereby compromising data integrity and auditability.

The vulnerability affects the wplegalpages WordPress plugin WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode. All releases up to and including version 4.3.7 are impacted. Any site running the plugin at version 4.3.7 or earlier should be considered vulnerable.

The CVSS v3 base score of 4.3 indicates moderate risk, and the EPSS score of less than 1 % suggests a low probability of exploitation currently. The flaw is not listed in the CISA KEV catalog. Exploitation requires only that an attacker successfully social‑engineer a site administrator into clicking a forged link; no authentication or elevated privileges are needed on the attacker side. Once triggered, the attacker can delete or resolve arbitrary GDPR request records stored in the wpl_data_req database table, potentially causing legal and compliance repercussions.