CVE-2026-12272: Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant

Q: Which sites are realistically exposed to PHP code injection?

Sites using Lightweight Cookie Notice versions through 1.19 are affected by the information exposure. Arbitrary PHP code injection may be possible only when W3 Total Cache is also installed, because the disclosed value is the W3 Total Cache mfunc security key.

Q: Does exploitation require an account or user interaction?

No. The issue is described as exploitable by unauthenticated attackers, with no user interaction required.

Q: What should be prioritized during triage?

Identify WordPress sites running Lightweight Cookie Notice version 1.19 or earlier and determine whether W3 Total Cache is installed. Systems with both plugins present should be prioritized because the exposed key may enable arbitrary PHP code injection.

Published Oct 16, 2026

Updated

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TCDYNAMICSECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.

Affected Software

1 affected component

Lightweight Cookie Notice – Cookie Banner for Cookie Consent<=1.19

Event History

Oct 16, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are realistically exposed to PHP code injection?

Sites using Lightweight Cookie Notice versions through 1.19 are affected by the information exposure. Arbitrary PHP code injection may be possible only when W3 Total Cache is also installed, because the disclosed value is the W3 Total Cache mfunc security key.

Does exploitation require an account or user interaction?

No. The issue is described as exploitable by unauthenticated attackers, with no user interaction required.

What should be prioritized during triage?

Identify WordPress sites running Lightweight Cookie Notice version 1.19 or earlier and determine whether W3 Total Cache is installed. Systems with both plugins present should be prioritized because the exposed key may enable arbitrary PHP code injection.

CVE-2026-12272: Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant

Affected Software

Event History

Frequently Asked Questions

Which sites are realistically exposed to PHP code injection?

Does exploitation require an account or user interaction?

What should be prioritized during triage?

Company

Resources

Contact

Frequently Asked Questions

Which sites are realistically exposed to PHP code injection?

Does exploitation require an account or user interaction?

What should be prioritized during triage?