What the vulnerability does
01Description
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints in all versions up to, and including, 4.4.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
02Summary
WPLP Cookie Consent versions up to 4.4.1 allow unauthenticated attackers to upload files of dangerous types to the site without restriction. An attacker can upload executable files such as PHP scripts, gaining the ability to run their own code on the site and take full control. No user interaction or authentication is required.
What an attacker can do
03Attacker Capabilities
Upload and execute malicious files on the site, gaining full control over the WordPress installation.
Potential impact on your site
04Site Impact
Complete site compromise: attacker can read all data, modify content, steal credentials, and inject malware.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
September 1, 2026
CVE published
September 1, 2026
Record updated
