CVE-2026-85132
Deferred Deferred - Pending Action

Unauthenticated Access to Cookie Scanner Schedule in WPLP Cookie Consent

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-29
AI Q&A
2026-09-09
EPSS Evaluated
2026-09-27
NVD
CVE-2026-85132
EUVD
EUVD-2026-74718

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wplp cookie_consent to 4.4.2 (exc)
wplp cookie_consent From 4.0.2 (inc) to 4.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WPLP Cookie Consent WordPress plugin versions 4.0.2 to 4.4.1. It allows any authenticated user, including low-privilege subscribers, to view the automated cookie scan schedule set by the administrator due to missing security checks (nonce or capability checks) on an AJAX action.

Detection Guidance

Check if the WPLP Cookie Consent plugin version is between 4.0.2 and 4.4.1. Log in as a subscriber and attempt to access the automated scan schedule via the vulnerable AJAX action. If the schedule is accessible, the vulnerability is present.

Impact Analysis

An attacker with basic access could learn the administrator's automated scan schedule, potentially revealing when sensitive data processing occurs. This could aid in timing further attacks or gathering information about the site's security practices.

Compliance Impact

This vulnerability may impact compliance by exposing cookie scan schedules, which could reveal user tracking or data processing timelines. GDPR requires transparency in data processing, and unauthorized access to such schedules could undermine compliance efforts.

Mitigation Strategies

Update the WPLP Cookie Consent plugin to version 4.4.2 or later immediately. If updating is not possible, disable the plugin until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85132. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart