Executive Summary

A critical vulnerability has been discovered in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress, tracked as CVE-2026-75865. This vulnerability has a CVSS score of 9.8 and allows unauthenticated attackers to upload arbitrary files on the affected site's server, potentially leading to remote code execution. All versions up to and including 4.4.1 are affected.

Technical Analysis

The vulnerability is caused by missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints. This classifies as an Arbitrary File Upload vulnerability. An attacker can reach and trigger this flaw by interacting with the vulnerable REST endpoints.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the WPLP connector REST endpoints. Specifically, the attacker would send a request that includes a malicious file, which is not properly validated by the saas_upload_logo() function. This allows the attacker to upload arbitrary files on the affected site's server. If the uploaded file contains malicious code, it could lead to remote code execution when executed.

Impact Assessment

The WPLP Cookie Consent plugin versions up to and including 4.4.1 are affected. Successful exploitation of this vulnerability could allow an attacker to achieve arbitrary file upload and potentially remote code execution on the server. The CVSS score of 9.8 indicates a critical severity level, with high impacts on confidentiality, integrity, and availability.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the WPLP Cookie Consent plugin to version 4.4.2 or later. Additionally, users should monitor their site's file uploads and server logs for any suspicious activity and implement a Web Application Firewall (WAF) rule to block malicious file upload attempts.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence