CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.

Score

CVSS 3.1 5.4 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-09

Last modified

2026-09-09

Weaknesses

CWE-862

Affected products

• Wplp Cookie Consent (Unknown)

References

• https://wpscan.com/vulnerability/3c43baf6-e2b1-4d6a-ab3f-b8be26f61c9f/