Is CVE-2026-82184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82184 being exploited in the wild.

How severe is CVE-2026-82184?

Medium severity, with a CVSS score of 5.3, published 9 September 2026.

Which products and versions are affected?

WPLP Cookie Consent before 4.4.2.

Is there a fix for CVE-2026-82184?

A patch was published on 2026-09-07: Fixed in version 4.4.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82184 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82184?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82184: WPLP Cookie Consent authorization bypass in consent option update

CVE-2026-82184 · Severity: medium · CVSS 5.3 · Published 2026-09-09

WPLP Cookie Consent is a WordPress plugin that manages visitor cookie consent via a cookie banner. The plugin fails to validate user identity or session tokens when processing consent updates, allowing anyone to remotely change consent settings for all site visitors. An attacker can inject malicious consent data that will be served to every visitor, potentially leading to tracking bypasses or other consent-related compromises.

Quick answers

Is CVE-2026-82184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82184 being exploited in the wild.
How severe is CVE-2026-82184?: Medium severity, with a CVSS score of 5.3, published 9 September 2026.
Which products and versions are affected?: WPLP Cookie Consent before 4.4.2.
Is there a fix for CVE-2026-82184?: A patch was published on 2026-09-07: Fixed in version 4.4.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82184 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82184?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the IAB TCF consent data update mechanism. The vulnerable code runs on every front-end page load without validating CSRF tokens or user authentication. An unauthenticated attacker can send a POST request to any front-end URL with arbitrary consent data (tcString, allVendorsSelected, allvendorIds) which is then stored as a site-wide WordPress option and served to all visitors. The cookie banner is enabled by default and no additional prerequisites are needed to exploit this. Proof-of-concept code demonstrates reading current values from page source and overwriting them with injected data in a single unauthenticated POST request. The vulnerability is fixed in version 4.4.2.

Affected products

WPLP Cookie Consent before 4.4.2

Timeline

2026-09-07: disclosed
2026-09-07: patched: Fixed in version 4.4.2

References

https://wpscan.com/vulnerability/54f2da44-84c2-4c56-88f3-615ae4054ecb/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.