CVE-2026-82184 Overview
CVE-2026-82184 affects the WPLP Cookie Consent WordPress plugin in versions prior to 4.4.2. The plugin stores visitor consent state on every front-end page load without performing authorization or Cross-Site Request Forgery (CSRF) checks. Unauthenticated attackers can overwrite a site-wide WordPress option with arbitrary data by triggering the vulnerable code path. The weakness is categorized as Missing Authorization [CWE-862]. Successful exploitation impacts data integrity across the affected site.
Critical Impact
Unauthenticated remote attackers can overwrite a site-wide WordPress option with arbitrary values, corrupting cookie consent configuration and other option data.
Affected Products
- WPLP Cookie Consent WordPress plugin versions before 4.4.2
- WordPress sites with the vulnerable plugin activated
- Any front-end page load path that invokes the consent-storage routine
Discovery Timeline
- 2026-09-09 - CVE-2026-82184 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-82184
Vulnerability Analysis
The WPLP Cookie Consent plugin exposes a consent-storage routine that runs during every front-end request. The routine writes to a site-wide WordPress option without validating the requester or the request origin. Attackers can send crafted requests to any public page and overwrite the stored option with attacker-controlled data.
The flaw affects integrity rather than confidentiality or availability. Because the modified option controls plugin behavior and stored consent state, the attacker can disrupt consent enforcement and corrupt configuration values used across the site.
Root Cause
The root cause is Missing Authorization [CWE-862] combined with the absence of CSRF nonce verification. The plugin does not call WordPress capability checks such as current_user_can() or verify a nonce with wp_verify_nonce() before invoking the option update. Every unauthenticated visitor reaches the same code path that performs the write.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single HTTP request to any public URL on the target WordPress site. The consent-storage handler executes and writes attacker-supplied values to the site-wide option through update_option() or an equivalent WordPress API call.
No verified proof-of-concept code is available. Refer to the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-82184
Indicators of Compromise
- Unexpected modifications to the WPLP Cookie Consent option in the wp_options table
- Anomalous POST requests or crafted GET requests to front-end URLs originating from unauthenticated sources
- Consent banner behavior or configuration values that change without administrator action
Detection Strategies
- Audit the wp_options table for values associated with WPLP Cookie Consent and compare against a known-good baseline
- Review web server access logs for high-volume or repeated requests to public pages carrying consent-related parameters
- Enable WordPress activity logging plugins to record option changes and correlate them with authenticated sessions
Monitoring Recommendations
- Alert when plugin options are modified outside of administrator sessions or scheduled maintenance windows
- Monitor for requests containing consent-storage parameters from IP ranges not associated with legitimate visitors
- Track plugin version inventory across managed WordPress sites to identify hosts still running vulnerable releases
How to Mitigate CVE-2026-82184
Immediate Actions Required
- Upgrade the WPLP Cookie Consent plugin to version 4.4.2 or later on all affected WordPress installations
- Review the current value of the plugin's site-wide option and restore known-good configuration if tampering is suspected
- Restrict administrative access to WordPress and enforce web application firewall rules for unauthenticated write attempts
Patch Information
The vendor addressed the issue in WPLP Cookie Consent version 4.4.2. The fixed release adds authorization and CSRF verification to the consent-storage handler. See the WPScan Vulnerability Report for the vendor advisory reference.
Workarounds
- Deactivate the WPLP Cookie Consent plugin until the patched version is installed
- Deploy a web application firewall rule to block unauthenticated requests that carry the consent-storage parameters
- Limit write access to the wp_options table at the database layer where operationally feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
