CVE-2026-85133: WPLP Cookie Consent Auth Bypass Flaw

CVE-2026-85133 Overview

CVE-2026-85133 affects the WPLP Cookie Consent WordPress plugin in versions before 4.4.2. The plugin fails to enforce nonce validation and capability checks on several settings AJAX actions. Any authenticated user, including a low-privileged subscriber, can read and destroy scan data belonging to the administrator. The same flaw lets attackers overwrite the plugin's stored configuration. The vulnerability is classified as Missing Authorization [CWE-862].

Critical Impact
Authenticated subscribers can tamper with cookie consent configuration and delete administrator scan data, undermining site privacy compliance.

Affected Products

WPLP Cookie Consent WordPress plugin versions before 4.4.2

Discovery Timeline

2026-09-09 - CVE-2026-85133 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85133

Vulnerability Analysis

The WPLP Cookie Consent plugin registers multiple AJAX actions handled through WordPress's wp_ajax_ hook. These handlers dispatch privileged operations such as reading scan results, deleting scan data, and updating plugin configuration. The affected handlers do not verify the caller's capability with current_user_can() and do not validate a request nonce with check_ajax_referer().

Because wp_ajax_ (as opposed to wp_ajax_nopriv_) only requires a valid login cookie, any authenticated role, including subscribers, can invoke these actions. Attackers can read administrator scan data, delete it, or push a crafted configuration payload that overwrites the stored plugin settings.

Root Cause

The root cause is missing authorization on privileged AJAX endpoints. The plugin trusts that any authenticated request is an administrator request. It does not gate settings mutation behind an administrator capability such as manage_options, and it does not require a signed nonce to prove the request originated from the plugin's own settings screen.

Attack Vector

An attacker must hold a valid WordPress account on the target site at any privilege level. The attacker sends a crafted POST request to wp-admin/admin-ajax.php specifying the vulnerable action parameter and the desired payload. The server executes the requested operation because no capability or nonce check rejects the request. See the WPScan Vulnerability Report for handler-level details.

Detection Methods for CVE-2026-85133

Indicators of Compromise

Unexpected POST requests to admin-ajax.php from user accounts that never touch plugin settings, especially subscriber accounts.
Missing or zeroed scan data in the WPLP Cookie Consent dashboard that administrators did not clear.
Plugin configuration values, such as banner text or category settings, changed without a corresponding administrator audit log entry.

Detection Strategies

Review web server access logs for admin-ajax.php requests carrying WPLP Cookie Consent action parameters originating from non-administrator sessions.
Compare current plugin option values in wp_options against a known-good baseline to detect unauthorized overwrites.
Enable and monitor a WordPress audit logging plugin to record configuration changes and AJAX-driven option updates.

Monitoring Recommendations

Alert on any subscriber or contributor account issuing requests to plugin-specific AJAX actions.
Track failed and successful authentications for low-privileged accounts followed by administrative AJAX traffic.
Monitor for spikes in admin-ajax.php traffic tied to the WPLP Cookie Consent action namespace.

How to Mitigate CVE-2026-85133

Immediate Actions Required

Upgrade the WPLP Cookie Consent plugin to version 4.4.2 or later on all WordPress sites.
Audit existing WordPress user accounts and remove unused subscriber, contributor, or author accounts.
Restore administrator scan data from backups if tampering or deletion is confirmed.

Patch Information

The vendor addressed the missing authorization flaw in WPLP Cookie Consent version 4.4.2. The fix introduces capability checks and nonce validation on the affected AJAX handlers. Site operators should apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the WPLP Cookie Consent plugin until it can be updated to 4.4.2.
Restrict user registration and require administrator approval for new WordPress accounts.
Deploy a web application firewall rule that blocks unauthenticated-role requests to the vulnerable AJAX actions.

bash

# Update the plugin using WP-CLI
wp plugin update wplp-cookie-consent --version=4.4.2
wp plugin list --name=wplp-cookie-consent --fields=name,status,version