CVE-2026-82970: WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files.
This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Cookie Notice for GDPR, CCPA & ePrivacy Consentto a version that resolves this vulnerability.Fixed in 4.4.2
Event History
Frequently Asked Questions
Which installations should be treated as affected?
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions through 4.4.1 are affected. The earliest affected version is not specified.
Does exploitation require an account or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What could successful exploitation affect?
The CVSS assessment rates confidentiality, integrity, and availability impacts as high, with scope changed. This indicates compromise may affect resources beyond the vulnerable component's original security authority.