CVE-2026-85131
WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
- State
- Published
- Severity
- 6.5 Medium
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 3, 2026
Description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
WPLP Cookie ConsentUnknown |
|
References
- https://wpscan.com/vulnerability/5a94c9c8-5b30-4735-be6b-ced53ff587bc/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.