WPLP Cookie Consent allows forged admin bulk actions to delete unrelated posts
WPLP Cookie Consent before 4.4.4: An attacker can trick a logged-in administrator into submitting a bulk-action request. The handler lacks both CSRF and capability checks and fails to limit targets to the plugin's own records, allowing permanent deletion of arbitrary posts and pages. The export does not name the action, target-ID field or handler.
- Component
- WPLP Cookie Consent
- Plugin slug
gdpr-cookie-consent- Affected
- < 4.4.4
- Safe version
4.4.4- Published
- Sep 16, 2026
This CVE was published Sep 16, 2026 and is one of 22 known issues for this plugin.
Update, patch or deactivate.
Update WPLP Cookie Consent to 4.4.4 or later. Require capability and action-bound nonce checks, constrain record types to the plugin's own data, and prefer recoverable deletion. Investigate unexpected deletions and recover content from backups.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N