CVE-2026-12920: SQL Injection in WPLP Cookie Consent WordPress Plugin

Technical summary

CVE-2026-12920 is a SQL injection flaw (CWE-89) in the WPLP Cookie Consent plugin affecting all versions through 4.3.5. The vulnerability exists in the handling of the 's' parameter, where user-supplied input is neither properly escaped nor parameterized before being incorporated into SQL queries. An attacker with administrator privileges can append additional SQL statements to existing queries, enabling unauthorized data exfiltration from the database. The CVSS v3.1 score of 4.9 (MEDIUM) reflects the high confidentiality impact, though exploitation is limited to authenticated high-privilege users.

Business impact

In WordPress installations with the WPLP Cookie Consent plugin, a compromised administrator account—or a legitimate admin with malicious intent—can extract sensitive data including user records, customer information, and site configuration details. This could lead to privacy violations, regulatory exposure (particularly under GDPR and CCPA), and reputational damage. Affected organizations should prioritize identifying plugin installations and verifying administrator account integrity.

Affected systems

The vulnerability affects WordPress sites using the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin in any version up to and including 4.3.5. No information on newer versions or patch availability is provided in the advisory; verify the current plugin version and consult the vendor for update status.

Exploitability

Exploitation requires authenticated access with administrator-level privileges, significantly limiting the attack surface. However, the barrier is not insurmountable: compromised admin accounts, insider threats, or supply-chain compromises of plugin developers could enable attacks. The network-accessible nature of the vulnerability (AV:N) means no additional network prerequisites are needed once credentials are obtained. Detection and prevention depend on robust access controls and credential hygiene.

Remediation

Organizations should immediately verify which WordPress installations use the WPLP Cookie Consent plugin and identify the installed version. Upgrade to a patched version if available from the plugin vendor—consult the official plugin repository or vendor advisory for version 4.3.6 or later. Until patching is possible, restrict administrator account access to trusted users, enforce strong password policies, enable multi-factor authentication, and monitor database query logs for suspicious SQL activity.

Patch guidance

Check the official WordPress plugin repository and the plugin vendor's advisory for available updates beyond version 4.3.5. Apply patches at your earliest maintenance window, prioritizing production sites with sensitive customer data. Verify the patched version has been tested in a staging environment before production deployment. If no vendor patch is available within a defined timeframe, evaluate alternative GDPR/CCPA compliance plugins with better security practices.

Detection guidance

Monitor WordPress administrator activity, particularly any use of the cookie consent plugin's settings or filtering functionality. Log and alert on unusual database queries, especially those containing UNION, SELECT, or other SQL commands appended to expected queries. Review WordPress audit logs for admin account access from unusual locations or times. Consider implementing a Web Application Firewall (WAF) rule set to detect SQL injection patterns in HTTP parameters, though this is a secondary control to patching.

Why prioritize this

While the CVSS score is MEDIUM and exploitation requires high-privilege access, this vulnerability affects a security and compliance plugin trusted to handle sensitive user consent data. The combination of direct database access potential and the plugin's role in GDPR/CCPA compliance makes this a priority for timely remediation, particularly in organizations subject to privacy regulations.

Risk score, explained

The CVSS v3.1 score of 4.9 reflects high confidentiality impact (C:H) but limited access requirements (PR:H—high privilege required). The score appropriately penalizes the privilege requirement while acknowledging the serious data exposure risk. Organizations handling sensitive data should treat this as higher priority than the score alone suggests, as insider threats and credential compromise are realistic scenarios.

Frequently asked questions