A critical (CVSS 9.8) arbitrary file upload flaw in the WPLP Cookie Consent WordPress plugin lets unauthenticated attackers write files to the server, potentially leading to remote code execution.
What Is It
CVE-2026-75865 is an arbitrary file upload vulnerability (CWE-434) in the "WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode" plugin for WordPress, published by vendor wplegalpages.
The flaw has two parts working together. The saas_upload_logo() function is missing file type validation, and the WPLP connector REST endpoints carry an authorization bypass. Chained, they allow an attacker with no credentials to upload arbitrary files to the affected site's server, which may make remote code execution possible.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. Base score: 9.8, CRITICAL.
Why It Matters
Every barrier that normally slows exploitation is absent here. There is no login requirement, no social engineering step, and no special positioning; the vulnerable REST endpoints are reachable over the network by anyone. An attacker who lands a web shell through this path owns the site.
Cookie consent plugins are installed broadly and largely forgotten after setup, which tends to leave a long tail of unpatched installations well after a fix ships.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation to report at this time.
What's Vulnerable
- Vendor: wplegalpages
- Product: WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode (WordPress plugin)
- Affected versions: all versions up to and including 4.4.1
- Component:
saas_upload_logo()function; WPLP connector REST endpoints
Patch Status
The NVD record does not name a fixed version. However, a WordPress plugin repository changeset (3674117, gdpr-cookie-consent) is referenced as a source, indicating a code change has been committed upstream.
Administrators should verify their installed version against the plugin repository and update past 4.4.1 to the latest available release. No official required-action deadline exists, as this CVE is not in the supplied KEV catalog.
Sources
- NVD, CVE-2026-75865: https://nvd.nist.gov/vuln/detail/CVE-2026-75865
- WordPress Plugin Repository Changeset 3674117: https://plugins.trac.wordpress.org/changeset/3674117/gdpr-cookie-consent
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/96a2a552-e73f-4b27-88de-50eb63a8d131?source=cve