Executive brief
The WPLP Cookie Consent WordPress plugin is a tool that manages cookie consent banners shown to website visitors. A low-privileged user (such as a subscriber) can bypass permission checks to overwrite the cookie banner configuration displayed to all visitors and irreversibly reset A/B testing data used to optimize banner performance.
Technical details
The vulnerability is a missing authorization check (CWE-862) in A/B testing actions within the plugin. The vulnerable AJAX endpoints (set_default_test_banner_1 and ab_testing_enable) lack both capability checks and nonce validation, allowing any authenticated user to invoke them. An attacker can send crafted POST requests to wp-admin/admin-ajax.php without a valid nonce to overwrite banner settings and reset counters. No user interaction or elevated privileges are required beyond WordPress authentication at the subscriber level. The vulnerability is fixed in version 4.4.2 and later.
Affected products
- WP-Legerity WPLP Cookie Consent before 4.4.2
Timeline
- 2026-09-07: disclosed
- 2026-09-09: patched: version 4.4.2