CVE-2026-15136
Received Received - Intake

Cross-Site Request Forgery in Cookie Banner for GDPR/CCPA – WPLP Cookie Consent

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process_bulk_action function. This makes it possible for unauthenticated attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-15136
EUVD
EUVD-2026-49694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wplp cookie_consent to 4.3.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin. It affects versions up to 4.3.7 due to missing or incorrect nonce validation in the process_bulk_action function. Attackers can exploit this to permanently delete or resolve GDPR data request records in the wpl_data_req table by tricking a site administrator into clicking a malicious link.

Detection Guidance

This vulnerability can be detected by checking for unauthorized changes to the wpl_data_req table in your WordPress database. Look for missing or incorrect nonce validation in the Cookie Banner for GDPR / CCPA plugin. Review server logs for suspicious bulk action requests.

Impact Analysis

If you use this plugin, an attacker could trick an administrator into clicking a link, leading to unauthorized deletion or modification of GDPR data request records. This could result in loss of important user data requests, compliance issues, or disruption of normal site operations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR by allowing unauthorized deletion or modification of GDPR data request records. GDPR requires proper handling and retention of user data requests, so such actions could violate regulatory requirements and result in legal consequences.

Mitigation Strategies

Immediately update the Cookie Banner for GDPR / CCPA plugin to version 4.3.8 or later. Disable the plugin if an update is not available. Implement additional nonce validation checks in your WordPress environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart