CVE-2026-82185: WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WPLP Cookie Consentto a version that resolves this vulnerability.Fixed in 4.4.2 - Operational
After upgrading WPLP Cookie Consent to 4.4.2 or later, irreversibly reset the stored A/B test results to clear any overwritten banner configuration and corrupted A/B test data.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit the affected A/B testing actions. This includes low-privilege accounts such as subscribers.
What can an attacker change or destroy?
An attacker can overwrite the cookie banner configuration displayed to every visitor. They can also irreversibly reset stored A/B test results.
Are unauthenticated visitors able to exploit it?
The issue is described as requiring an authenticated user. The provided information does not indicate that unauthenticated visitors can trigger the affected actions.
What version addresses the issue?
Versions before 4.4.2 are affected. Updating WPLP Cookie Consent to 4.4.2 or later addresses the stated vulnerable version range.