CVE-2026-12272
Received Received - Intake

Sensitive Information Exposure in Lightweight Cookie Notice WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-12272
EUVD
EUVD-2026-102667

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
daext Lightweight Cookie Notice – Cookie Banner for Cookie Consent 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is in the Lightweight Cookie Notice plugin for WordPress. It exposes a hardcoded security constant (W3TC_DYNAMIC_SECURITY) that is publicly known. This allows unauthenticated attackers to discover the W3 Total Cache mfunc security key, which could lead to arbitrary PHP code injection if W3 Total Cache is also installed.

Detection Guidance

Check if the Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin is installed and its version is up to 1.19. Look for exposed W3 Total Cache mfunc security keys due to the hardcoded W3TC_DYNAMIC_SECURITY constant.

Impact Analysis

If you use the affected plugin and W3 Total Cache together, attackers could exploit this to inject malicious PHP code into your WordPress site. This could lead to unauthorized access, data theft, or complete site compromise.

Compliance Impact

This vulnerability exposes sensitive information that could potentially lead to unauthorized access or code execution. For GDPR, it may violate principles of data protection by enabling unauthorized access to system configurations. For HIPAA, it could risk exposing protected health information if exploited in healthcare environments.

Mitigation Strategies

Update the Lightweight Cookie Notice plugin to the latest version beyond 1.19. If W3 Total Cache is installed, ensure its security keys are regenerated and the W3TC_DYNAMIC_SECURITY constant is not hardcoded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart