CVE-2026-82184: WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

Q: Which deployments are exposed?

Sites using WPLP Cookie Consent versions before 4.4.2 are affected. The vulnerable consent-state handling runs on every front-end page load.

Q: Does exploitation require authentication or a valid CSRF token?

No. The issue is described as lacking both authorization and CSRF checks, so an unauthenticated attacker can trigger the affected behavior.

Q: What can an attacker change?

An attacker can overwrite a site-wide option related to IAB TCF consent with arbitrary data.

Published Sep 9, 2026

Updated

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data.

Affected Software

1 affected component

WordPress plugin WPLP Cookie Consent<4.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WPLP Cookie Consent to a version that resolves this vulnerability.
Fixed in 4.4.2

Event History

Sep 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Sites using WPLP Cookie Consent versions before 4.4.2 are affected. The vulnerable consent-state handling runs on every front-end page load.

Does exploitation require authentication or a valid CSRF token?

No. The issue is described as lacking both authorization and CSRF checks, so an unauthenticated attacker can trigger the affected behavior.

What can an attacker change?