CVE-2026-15136 Overview
CVE-2026-15136 is a Cross-Site Request Forgery (CSRF) vulnerability in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress. The flaw affects all versions up to and including 4.3.7. The plugin's process_bulk_action function lacks proper nonce validation, allowing unauthenticated attackers to forge requests that permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req database table. Exploitation requires tricking a site administrator into clicking a malicious link or visiting an attacker-controlled page while authenticated. The vulnerability is tracked under CWE-352.
Critical Impact
Successful exploitation allows unauthenticated attackers to destroy GDPR/CCPA data request records, causing compliance violations and loss of regulated user data audit trails.
Affected Products
- Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress
- All versions up to and including 4.3.7
- WordPress sites with administrators susceptible to social engineering
Discovery Timeline
- 2026-07-28 - CVE-2026-15136 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15136
Vulnerability Analysis
The vulnerability resides in the process_bulk_action function of the WPLP Cookie Consent plugin, located in the class-wpl-data-req-table.php file. This function processes bulk operations against GDPR data request records but fails to validate an anti-CSRF nonce before executing the requested actions. As a result, any authenticated administrator's browser can be coerced into submitting a state-changing request without their knowledge or consent.
The affected actions include permanent deletion and forced resolution of records within the wpl_data_req table. This table stores data subject requests such as access, erasure, or portability submissions filed under GDPR and CCPA. Destroying these records damages the site owner's ability to demonstrate regulatory compliance and eliminates evidence of user rights requests.
Root Cause
The root cause is missing or incorrect nonce validation on a privileged state-changing operation. WordPress provides wp_verify_nonce() and check_admin_referer() helpers precisely to prevent forged administrative actions, but these controls are absent from the vulnerable bulk-action handler. Because the endpoint accepts requests based solely on the administrator's session cookie, any cross-origin request submitted by the victim's browser is treated as legitimate.
Attack Vector
An attacker crafts a malicious HTML page or link containing an auto-submitting form or image tag that targets the plugin's bulk-action endpoint with parameters that trigger the delete or resolve action. When a logged-in WordPress administrator visits the page or clicks the link, their browser transmits the request along with valid session cookies. The plugin executes the bulk action against the specified records in wpl_data_req. No authentication credentials are required from the attacker because the victim's browser supplies them automatically.
See the WordPress Plugin Code Review for the vulnerable handler, and the Wordfence Vulnerability Report for additional analysis.
Detection Methods for CVE-2026-15136
Indicators of Compromise
- Unexpected deletions or status changes in the wpl_data_req database table without corresponding administrator activity in audit logs.
- HTTP POST requests to the plugin's admin bulk-action endpoint containing action=delete or action=resolve parameters with a Referer header pointing to an external domain.
- Administrator sessions generating bulk-action requests immediately after visiting external URLs or opening email links.
Detection Strategies
- Monitor WordPress wp-admin access logs for cross-origin Referer headers on requests targeting the gdpr-cookie-consent plugin paths.
- Enable WordPress audit-logging plugins to record all modifications to GDPR data request records, including actor identity and source IP.
- Compare snapshots of the wpl_data_req table over time to identify unexplained record removals.
Monitoring Recommendations
- Alert on administrative bulk-action HTTP requests missing a valid _wpnonce parameter or containing suspicious Referer values.
- Track administrator browsing patterns for correlated events between external link clicks and immediate backend state changes.
- Retain database change logs for the wpl_data_req table for the duration required by applicable GDPR/CCPA regulations.
How to Mitigate CVE-2026-15136
Immediate Actions Required
- Update the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin to a version later than 4.3.7 once the vendor releases a patched build.
- Restrict WordPress administrator accounts to dedicated browsers or sessions used solely for administrative tasks.
- Back up the wpl_data_req table before applying updates so any tampered records can be restored.
Patch Information
Review the WordPress Plugin Changeset for the vendor's remediation commit. Administrators should install the fixed release from the WordPress Plugin Directory as soon as it becomes available and verify the plugin version reflects the patched build in the WordPress admin dashboard.
Workarounds
- Temporarily deactivate the WPLP Cookie Consent plugin until an updated version is available if GDPR data request handling is not actively used.
- Deploy a web application firewall rule that blocks requests to the plugin's bulk-action endpoint when the Referer header is missing or does not match the site's own origin.
- Instruct administrators to log out of WordPress sessions before browsing untrusted content or clicking links from unverified senders.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
