CVE-2026-14475: SQL Injection in WPLP Cookie Consent WordPress Plugin (Versions ≤4.3.6)

Technical summary

CVE-2026-14475 is a SQL injection vulnerability in the WPLP Cookie Consent plugin stemming from insufficient input escaping and lack of prepared statement usage on the 'scan_id' parameter. The vulnerability exists in the plugin's database query construction logic, allowing authenticated administrators to append arbitrary SQL statements to existing queries. The flaw is classified as CWE-89 (SQL Injection) and carries a CVSS 3.1 score of 4.9 (MEDIUM severity) with a vector indicating network-based attack requiring high privilege access but no user interaction.

Business impact

Organizations using this plugin face potential unauthorized database access and data exfiltration. An insider threat or compromised administrator account could be leveraged to extract customer data, payment information, or other sensitive records. The breach would likely trigger incident response procedures and potential regulatory notification obligations under GDPR, CCPA, and similar frameworks—ironic given the plugin's intended privacy compliance purpose.

Affected systems

The vulnerability affects the WPLP Cookie Consent for GDPR / CCPA plugin in all versions up to and including 4.3.6. Any WordPress installation running this plugin at a vulnerable version is at risk if an administrator account is compromised or a malicious administrator exists.

Exploitability

Exploitation requires administrator-level or above credentials on the WordPress instance. While this is a high privilege requirement, it reflects a realistic insider threat scenario or the result of a prior account compromise. Once authenticated as an administrator, the attack is straightforward—no special tools or user interaction is needed. The CVSS score does not indicate active public exploitation (this vulnerability is not listed in the KEV catalog).

Remediation

Update the WPLP Cookie Consent plugin to a patched version beyond 4.3.6. Verify the availability of a security patch from the plugin vendor and test the update in a staging environment before production deployment. Additionally, audit WordPress administrator accounts for unauthorized users and review access logs for suspicious database queries.

Patch guidance

Check the WordPress plugin repository or the plugin vendor's advisory for version 4.3.7 or later. Verify that the patched version includes proper input sanitization and uses prepared statements for the 'scan_id' parameter. Apply the update through the WordPress admin dashboard or via command-line tools (wp-cli). After patching, perform a security scan to confirm the SQL injection vector is no longer exploitable.

Detection guidance

Monitor WordPress error logs and database query logs for unusual SQL statements in the scan_id parameter context. Look for patterns such as UNION SELECT, INFORMATION_SCHEMA queries, or comments (-- or /*) appended to parameter values. WordPress security plugins such as Wordfence or Sucuri can detect such activity. Network-based detection should focus on administrator sessions generating unexpected database load or data access patterns.

Why prioritize this

Although the CVSS score is MEDIUM (4.9), the vulnerability warrants timely remediation because: (1) it affects a privacy-focused plugin, creating reputational risk; (2) the attack vector is straightforward for anyone with administrator credentials; (3) the impact is confidentiality loss on sensitive customer data. Organizations relying on this plugin for GDPR compliance should treat this as a compliance risk requiring urgent patching.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a MEDIUM severity rating. The score is moderated by the high privilege requirement (PR:H), which limits the attack surface. However, the high impact on confidentiality (C:H) and the network-accessible attack vector (AV:N) prevent the score from dropping further. The absence of integrity or availability impact (I:N, A:N) also factors into the moderate rating, though data extraction remains a serious concern.

Frequently asked questions