Executive brief
The WPLP Cookie Consent WordPress plugin, used to manage cookie consent and privacy compliance on websites, contains two critical flaws: missing file upload validation and an authorization bypass. Unauthenticated attackers can upload arbitrary files to affected websites, potentially leading to remote code execution and complete site compromise.
Technical details
The vulnerability stems from missing file type validation in the saas_upload_logo() function combined with an authorization bypass in the WPLP connector REST endpoints. An unauthenticated attacker can exploit these weaknesses to upload arbitrary files (e.g., PHP shells) to the server without authentication checks. The vulnerability affects all versions up to and including 4.4.1. Successful exploitation enables remote code execution with the privileges of the web server, allowing attackers to fully compromise the affected website.
Affected products
- WPLP Cookie Consent up to and including 4.4.1
Timeline
- 2026-09-01: disclosed: CVE-2026-75865 published