CVE-2026-82185: WPLP Cookie Consent Auth Bypass Flaw

CVE-2026-82185 Overview

CVE-2026-82185 affects the WPLP Cookie Consent WordPress plugin in versions prior to 4.4.2. The plugin fails to enforce capability or nonce checks on several A/B testing actions. Any authenticated user, including a low-privileged subscriber, can overwrite the cookie banner configuration presented to every site visitor. The same flaw permits an attacker to irreversibly reset stored A/B test results. The issue is classified as [CWE-862] Missing Authorization.

Critical Impact
Authenticated low-privilege users can tamper with cookie consent banners shown to all site visitors and destroy A/B testing data without recovery.

Affected Products

WPLP Cookie Consent WordPress plugin versions before 4.4.2
WordPress sites permitting subscriber-level registration with the plugin installed
Any site relying on the plugin's A/B testing feature for consent optimization

Discovery Timeline

2026-09-09 - CVE-2026-82185 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-82185

Vulnerability Analysis

The WPLP Cookie Consent plugin exposes several A/B testing AJAX actions that lack both capability checks and nonce verification. WordPress conventionally requires the current_user_can() capability check and check_ajax_referer() nonce validation on privileged actions. Missing both leaves the endpoints reachable to any logged-in account, including the default subscriber role that self-registration typically creates.

Because the affected actions manipulate the cookie banner configuration and A/B test results, an attacker can silently alter the consent experience for every visitor. The reset action for A/B test results is irreversible, so accumulated statistical data cannot be recovered after abuse.

Root Cause

The root cause is a missing authorization boundary [CWE-862] on server-side action handlers. The plugin registers A/B testing callbacks without gating them behind a capability appropriate to configuration changes, such as manage_options. The handlers also omit nonce checks, so requests cannot be tied to an administrative session.

Attack Vector

An attacker authenticates as any WordPress user, including a subscriber, and issues AJAX requests to the vulnerable A/B testing actions. The requests do not require CSRF token retrieval or elevation. Successful exploitation modifies the cookie banner shown to unauthenticated visitors or resets stored A/B test data. Confidentiality is not affected, but integrity of consent configuration and availability of test results are.

Refer to the WPScan Vulnerability Report for exploitation details. No public proof-of-concept code has been referenced in the enriched data.

Detection Methods for CVE-2026-82185

Indicators of Compromise

Unexpected changes to the cookie consent banner text, styling, or behavior displayed to visitors
A/B test result counters reset to zero without administrator action
Authenticated POST requests to admin-ajax.php referencing WPLP Cookie Consent A/B testing actions from subscriber accounts
New or dormant subscriber accounts issuing requests to plugin management endpoints

Detection Strategies

Review WordPress access logs for admin-ajax.php requests originating from non-administrator sessions targeting the plugin's A/B testing actions
Compare the current cookie banner configuration against a known-good baseline stored outside the database
Alert when plugin option rows in wp_options are modified by user IDs that do not hold administrative capabilities

Monitoring Recommendations

Enable WordPress audit logging to record option changes, user role assignments, and AJAX action invocations
Ingest web server and PHP application logs into a centralized analytics platform for correlation across sessions
Monitor for spikes in new subscriber registrations followed by AJAX activity to plugin endpoints

How to Mitigate CVE-2026-82185

Immediate Actions Required

Upgrade the WPLP Cookie Consent plugin to version 4.4.2 or later on all WordPress sites
Audit existing subscriber and low-privilege accounts and remove any created without a business justification
Restore the intended cookie banner configuration from a trusted backup if tampering is confirmed
Disable open user registration if the site does not require it

Patch Information

The vendor addressed the issue in WPLP Cookie Consent version 4.4.2 by adding capability and nonce checks on the affected A/B testing actions. See the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the WPLP Cookie Consent plugin until the site can be patched to 4.4.2
Set the WordPress users_can_register option to false to prevent unauthenticated attackers from provisioning subscriber accounts
Restrict access to wp-admin/admin-ajax.php for unauthenticated and low-privilege sessions using a web application firewall rule

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
wp plugin update wplp-cookie-consent --version=4.4.2