CVE-2026-82970: WP Cookie Notice File Upload Vulnerability

CVE-2026-82970 Overview

CVE-2026-82970 is an unrestricted file upload vulnerability in the WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin. The flaw affects all plugin versions from initial release through 4.4.1. Unauthenticated attackers can upload arbitrary files with dangerous types to vulnerable WordPress sites. Successful exploitation grants remote code execution on the underlying web server, leading to full site compromise. The weakness is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Unauthenticated attackers can upload malicious files such as PHP webshells and execute arbitrary code, resulting in full compromise of the WordPress site and pivoting to adjacent systems.

Affected Products

WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent — all versions up to and including 4.4.1
WordPress sites running the vulnerable plugin (gdpr-cookie-consent)
Hosting environments where the WordPress uploads directory permits PHP execution

Discovery Timeline

2026-08-31 - CVE-2026-82970 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82970

Vulnerability Analysis

The vulnerability resides in a file upload handler exposed by the plugin that fails to validate file type, extension, and MIME content before writing the uploaded file to disk. An unauthenticated remote attacker can submit a crafted multipart HTTP request that delivers an executable payload such as a PHP script. Once written to a web-accessible directory, the attacker requests the uploaded file to trigger server-side execution. Because the plugin exposes the upload endpoint without authentication or capability checks, no user interaction or credentials are required.

The attack executes over the network, requires low complexity, and impacts confidentiality, integrity, and availability across security scopes. Compromise typically leads to persistent webshell installation, credential theft from wp-config.php, database exfiltration, and lateral movement into shared hosting tenants.

Root Cause

The root cause is missing enforcement of an allow-list on uploaded file extensions and MIME types, combined with missing authentication on the upload endpoint. The handler trusts client-supplied metadata and writes files under the WordPress uploads path without sanitizing the filename or verifying the caller's capability.

Attack Vector

An attacker sends a POST request to the vulnerable plugin endpoint with a payload containing a PHP file disguised or declared as an allowed content type. After the server stores the file, the attacker issues a direct HTTP GET request to the uploaded path, causing the web server to execute the embedded PHP code and return command output. See the Patchstack WordPress Vulnerability Report for advisory details.

No verified public proof-of-concept is available at time of publication. The EPSS score for CVE-2026-82970 is 0.29% (21st percentile).

Detection Methods for CVE-2026-82970

Indicators of Compromise

Unexpected .php, .phtml, .phar, or double-extension files (for example, image.jpg.php) under wp-content/uploads/ and plugin subdirectories.
Web access log entries with POST requests to gdpr-cookie-consent plugin endpoints from unauthenticated sources followed by GET requests to newly created upload paths.
Outbound connections from the www-data or PHP-FPM process to attacker-controlled infrastructure shortly after suspicious uploads.
New administrative WordPress users, modified wp-config.php, or scheduled tasks introduced without change-control records.

Detection Strategies

Hunt web server access logs for POST requests to plugin routes that contain multipart file payloads with executable extensions.
Monitor filesystem write events for .php files created in wp-content/uploads and correlate with the parent web server process.
Alert on WordPress admin user creation, plugin installation, and option changes that occur without an authenticated session cookie chain.

Monitoring Recommendations

Ingest WordPress access logs, PHP error logs, and filesystem audit events into a central SIEM for correlation.
Enable web application firewall (WAF) rules that block file uploads containing PHP tags (<?php) or shebang lines regardless of declared content type.
Baseline the contents of wp-content/uploads and alert on any executable file appearing in that tree.

How to Mitigate CVE-2026-82970

Immediate Actions Required

Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to a version later than 4.4.1 as soon as the vendor publishes a fix.
Deactivate and remove the plugin until a patched release is available if the site does not require its functionality.
Audit wp-content/uploads and plugin directories for unexpected executable files and remove any confirmed webshells.
Rotate all WordPress administrator credentials, database credentials in wp-config.php, and API keys stored in the environment.

Patch Information

The advisory covers versions from initial release through 4.4.1. Consult the Patchstack WordPress Vulnerability Report and the WordPress plugin repository for the latest fixed release before applying updates in production.

Workarounds

Block requests to the vulnerable plugin upload endpoint at the WAF or reverse proxy until the plugin is patched or removed.
Disable PHP execution inside wp-content/uploads using web server configuration to neutralize dropped webshells.
Restrict access to the WordPress admin and plugin AJAX endpoints by source IP where operationally feasible.

bash

# Apache: disable PHP execution inside the WordPress uploads directory
# Place this file at wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (add to the server block serving WordPress)
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9]+)$ {
    deny all;
    return 403;
}