CVE-2026-75865: WordPress WPLP Cookie Consent RCE Vulnerability

CVE-2026-75865 Overview

The WPLP Cookie Consent plugin for WordPress contains an arbitrary file upload vulnerability in the saas_upload_logo() function. The flaw stems from missing file type validation combined with an authorization bypass on the WPLP connector REST endpoints. Unauthenticated attackers can upload arbitrary files to the affected server, which may lead to remote code execution. The vulnerability affects all plugin versions up to and including 4.4.1. This plugin is marketed for GDPR, CCPA, and Google Consent Mode compliance and is widely deployed across WordPress sites.

Critical Impact
Unauthenticated remote attackers can upload executable files to WordPress servers and achieve arbitrary code execution.

Affected Products

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress
All versions up to and including 4.4.1
WordPress installations exposing the WPLP connector REST endpoints

Discovery Timeline

2026-09-01 - CVE-2026-75865 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75865

Vulnerability Analysis

The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. The saas_upload_logo() function accepts file uploads without validating the file type, extension, or content. Attackers can therefore submit files containing PHP payloads instead of image data. Because the WPLP connector REST endpoints also fail to enforce authorization checks, requests reaching this function do not require authentication or elevated privileges. An attacker who uploads a PHP file into the WordPress uploads directory can then request that file directly to trigger code execution under the web server's user context.

Root Cause

Two defects combine to produce the impact. First, saas_upload_logo() does not verify uploaded file extensions or MIME types against an allowlist. Second, the REST route registered by the WPLP connector lacks a proper permission_callback, allowing anonymous requests to reach the upload handler. The WordPress changeset shows the corrective code introduced by the vendor.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP POST request to the vulnerable WPLP REST endpoint with a PHP payload disguised as a logo asset. The server writes the file to a publicly accessible location. The attacker then issues a GET request to the uploaded file to execute the payload. No user interaction, credentials, or prior foothold are needed. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-75865

Indicators of Compromise

Unexpected .php, .phtml, or .phar files inside the wp-content/uploads/ directory tree, especially under plugin-specific subfolders
POST requests to WPLP connector REST routes (paths containing gdpr-cookie-consent or the SaaS logo upload endpoint) originating from unauthenticated sessions
Web server access logs showing direct GET requests to newly created files in the uploads directory shortly after a POST upload
New administrator accounts or modified WordPress core files following anonymous requests to the plugin's REST endpoints

Detection Strategies

Inspect HTTP request bodies to the WPLP REST endpoints for multipart uploads whose filename or content indicates non-image types
Alert on file system creation events in wp-content/uploads/ where the file extension is executable by PHP-FPM or mod_php
Correlate REST API calls to saas_upload_logo() with subsequent outbound network connections from the PHP worker process

Monitoring Recommendations

Enable WordPress request logging and forward web server logs to a centralized analytics platform for retention and query
Deploy file integrity monitoring on the wp-content/uploads/ and plugin directories
Monitor process execution telemetry from the WordPress host for shells, wget, curl, or php invocations spawned by the web server user

How to Mitigate CVE-2026-75865

Immediate Actions Required

Update the WPLP Cookie Consent plugin to a version later than 4.4.1 that contains the fix from changeset 3674117
If patching is not immediately possible, deactivate and remove the plugin until an update can be applied
Audit the wp-content/uploads/ directory for unexpected executable files and remove them
Rotate WordPress administrator credentials and secret keys if any indicators of compromise are present

Patch Information

The vendor addressed the issue in the WordPress plugin repository via changeset 3674117. The patch adds file type validation to saas_upload_logo() and enforces authorization on the WPLP connector REST endpoints. Administrators should upgrade to the fixed release available through the WordPress plugin update mechanism.

Workarounds

Block requests to the vulnerable REST routes at a web application firewall until the plugin is updated
Configure the web server to disallow PHP execution within the wp-content/uploads/ directory using directives such as php_admin_flag engine off or equivalent Nginx location rules
Restrict access to /wp-json/ endpoints associated with the plugin to authenticated administrators via reverse proxy rules

bash

# Nginx: disable PHP execution inside the WordPress uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php7|php8)$ {
    deny all;
    return 403;
}