CVE-2026-85132: WPLP Cookie Consent Auth Bypass Flaw

CVE-2026-85132 Overview

CVE-2026-85132 affects the WPLP Cookie Consent WordPress plugin in versions before 4.4.2. The plugin exposes a cookie scanner AJAX action without nonce or capability checks. Any authenticated user, including a low-privileged subscriber, can invoke the action and read back the automated scan schedule configured by the administrator. The flaw is classified as Missing Authorization [CWE-862] and requires only a valid low-privilege session to exploit.

Critical Impact
Authenticated subscribers can retrieve administrator-configured cookie scanner schedule data through an unprotected AJAX endpoint, exposing internal site configuration.

Affected Products

WPLP Cookie Consent WordPress plugin versions prior to 4.4.2

Discovery Timeline

2026-09-09 - CVE-2026-85132 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85132

Vulnerability Analysis

The WPLP Cookie Consent plugin registers an AJAX action tied to its cookie scanner feature. The handler responds to requests from any authenticated user without verifying the caller's capability or validating a WordPress nonce. As a result, the endpoint returns the automated scan schedule that administrators configure through the plugin settings.

The exposed schedule data reveals when and how the site's cookie scanning routines execute. While the disclosed content is limited to configuration metadata, it provides reconnaissance value to attackers profiling the target environment. The vulnerability does not permit modification of the schedule or execution of arbitrary code.

Root Cause

The root cause is a missing authorization check on a WordPress AJAX action registered through the wp_ajax_ hook. The handler omits both current_user_can() capability verification and check_ajax_referer() nonce validation. WordPress treats any authenticated user, including subscribers, as a valid caller for wp_ajax_ handlers unless the plugin enforces its own access controls.

Attack Vector

Exploitation requires a valid WordPress account with at least subscriber-level access. The attacker sends an authenticated HTTP POST request to /wp-admin/admin-ajax.php specifying the vulnerable action parameter. The server returns the administrator-configured scan schedule in the response body. No user interaction from the administrator is required.

Refer to the WPScan Vulnerability Report for additional technical detail on the affected AJAX action.

Detection Methods for CVE-2026-85132

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php from accounts with subscriber or low-privilege roles
Repeated AJAX requests referencing the WPLP Cookie Consent scanner action from a single authenticated session
Access log entries showing non-administrator user IDs invoking plugin-specific admin-ajax actions

Detection Strategies

Correlate WordPress user role data with admin-ajax.php request patterns to flag low-privileged users invoking administrative plugin actions
Deploy a web application firewall rule to inspect action parameters in admin-ajax traffic against an allow list per role
Enable WordPress audit logging to record AJAX action invocations, source IP, and authenticated user identity

Monitoring Recommendations

Alert on newly created subscriber accounts that immediately generate admin-ajax.php traffic
Track baseline volume of admin-ajax requests per user role and flag statistical outliers
Monitor the WordPress plugin inventory for WPLP Cookie Consent installations below version 4.4.2

How to Mitigate CVE-2026-85132

Immediate Actions Required

Update the WPLP Cookie Consent plugin to version 4.4.2 or later on all WordPress sites
Audit existing subscriber and low-privilege accounts, removing any that are unnecessary or inactive
Review WordPress registration settings and disable open user registration where it is not required

Patch Information

The vendor addressed the missing authorization flaw in WPLP Cookie Consent version 4.4.2. The fix introduces capability and nonce checks on the affected cookie scanner AJAX handler. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Temporarily deactivate the WPLP Cookie Consent plugin until the patched version is deployed
Restrict access to /wp-admin/admin-ajax.php at the web application firewall for authenticated users below editor role where feasible
Enforce strong authentication and multi-factor authentication on all WordPress accounts to reduce the pool of usable subscriber sessions

bash

# Update WPLP Cookie Consent using WP-CLI
wp plugin update wplp-cookie-consent --version=4.4.2
wp plugin list --name=wplp-cookie-consent --fields=name,status,version