The vulnerability in the WPLP Cookie Consent WordPress plugin before version 4.4.2 occurs because several AJAX actions that manage settings lack nonce and capability checks, a flaw classified as CWE‑862. The missing authorization allows any authenticated user, including subscribers, to invoke those actions, enabling them to read, delete, or overwrite the plugin’s configuration and scan data. This results in potential data loss and unintended changes to cookie consent settings, affecting the confidentiality and integrity of site configuration.

WordPress installations that use the WPLP Cookie Consent plugin version earlier than 4.4.2 are impacted. The vendor is listed as Unknown:WPLP Cookie Consent. Sites running any earlier release of this plugin must address the issue.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild at present. The defect does not appear in CISA KEV. The attack vector is server‑side and requires only authentication; any logged‑in user, even a subscriber, can trigger the malicious AJAX calls. Thus, the threat is internal and requires proper role‑based controls to mitigate.