What’s Vulnerable › Vulnerabilities
CVE-2026-85131: WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-352
Description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Affected products
- WPLP Cookie Consent: before 4.4.4 — fixed in 4.4.4
How to fix
Upgrade to a fixed version: WPLP Cookie Consent 4.4.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85131 or the next vulnerability affects your stack