CVE-2026-14475: WPLP Cookie Consent SQLi Vulnerability

CVE-2026-14475 Overview

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress contains a SQL injection vulnerability [CWE-89] affecting all versions up to and including 4.3.6. The flaw resides in the scan_id parameter, which is passed to SQL queries without adequate escaping or use of prepared statements. Authenticated attackers holding administrator-level access can append arbitrary SQL clauses to existing queries and extract sensitive data from the WordPress database. The issue affects the plugin's cookie scanner module, specifically the AJAX handler class and the scanner class file.

Critical Impact
Administrator-level attackers can execute unauthorized SQL queries to exfiltrate sensitive database contents, including WordPress user credentials and session tokens.

Affected Products

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress
All versions up to and including 4.3.6
WordPress installations running the gdpr-cookie-consent plugin

Discovery Timeline

2026-07-10 - CVE-2026-14475 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-14475

Vulnerability Analysis

The vulnerability is a generic SQL injection [CWE-89] in the plugin's cookie scanner functionality. The scanner module accepts a scan_id parameter from user input and concatenates it into SQL queries executed against the WordPress database. The plugin does not apply wpdb->prepare() or equivalent parameterized query mechanisms, and input escaping is insufficient to neutralize SQL metacharacters.

Because the vulnerable endpoints require administrator privileges, exploitation is limited to authenticated users with elevated roles. This constrains the attack surface but remains relevant in multi-admin environments, compromised administrator accounts, or scenarios where an attacker chains this issue with a privilege escalation flaw.

Root Cause

The root cause is a failure to properly parameterize SQL queries constructed with user-supplied input. The affected code paths reside in class-wpl-cookie-consent-cookie-scanner.php and class-wpl-cookie-consent-cookie-scanner-ajax.php within the plugin's admin/modules/cookie-scanner/ directory. The scan_id value flows into query strings without being bound as a parameter, allowing SQL syntax to be injected.

Attack Vector

An authenticated administrator sends a crafted request to the scanner AJAX endpoint with a malicious scan_id value containing SQL syntax. The injected clause is appended to the underlying query, and results can be inferred through response contents or error output. See the Wordfence Vulnerability Analysis and the WordPress Cookie Scanner AJAX Class source for the vulnerable code paths.

Detection Methods for CVE-2026-14475

Indicators of Compromise

Unexpected admin-ajax.php POST requests referencing cookie scanner actions with unusual scan_id values containing SQL keywords such as UNION, SELECT, SLEEP, or comment sequences like -- and /*.
Anomalous read activity against WordPress tables such as wp_users or wp_usermeta originating from the plugin's database context.
Extended request durations on scanner endpoints that may indicate time-based blind SQL injection.

Detection Strategies

Inspect web server and WordPress logs for administrator sessions issuing scanner AJAX calls with scan_id parameters containing non-numeric or SQL metacharacter content.
Deploy a web application firewall rule that flags SQL syntax in the scan_id parameter to any gdpr-cookie-consent scanner endpoint.
Enable WordPress database query logging or SAVEQUERIES during triage to correlate suspicious queries with plugin execution.

Monitoring Recommendations

Alert on administrator account activity that includes access to scanner AJAX endpoints outside of expected maintenance windows.
Monitor for privilege escalation events or new administrator account creation that could precede exploitation.
Track outbound data volumes from the WordPress host to identify potential data exfiltration following database extraction.

How to Mitigate CVE-2026-14475

Immediate Actions Required

Update the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin to a version newer than 4.3.6 as soon as a fixed release is available.
Audit all WordPress administrator accounts and remove or downgrade any that are unnecessary.
Enforce multi-factor authentication for every administrator account to reduce the risk of credential-based compromise.

Patch Information

A fix was committed to the plugin repository. Review the WordPress Cookie Consent Changeset for the code modifications that address the SQL injection. Site operators should upgrade to the patched release referenced in the changeset and confirm the plugin version reported in the WordPress admin dashboard matches or exceeds the fixed version.

Workarounds

Temporarily deactivate the gdpr-cookie-consent plugin until the patched version is installed.
Restrict access to wp-admin and admin-ajax.php by IP allowlist at the web server or WAF layer.
Apply virtual patching rules that reject requests where the scan_id parameter contains non-integer characters.

bash

# Example WAF/Nginx rule to block non-numeric scan_id values
if ($arg_scan_id !~ "^[0-9]+$") {
    return 403;
}