Description

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-04T07:17:10.647Z",
  "pubdate": "2026-09-04T07:17:10.647Z",
  "executiveSummary": "The WPLP Cookie Consent WordPress plugin, in versions prior to 4.4.2, contains a SQL injection vulnerability resulting from insufficient input validation of a pagination parameter.\nThis flaw allows an attacker with administrator privileges to manipulate backend database queries by injecting arbitrary SQL commands.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the database, potentially leading to unauthorized data exfiltration, modification, or complete compromise of the underlying data store.\nSuccessful exploitation requires that the attacker has already obtained administrative access to the WordPress dashboard, limiting the initial attack surface but significantly increasing the impact of a compromised administrative account.",
  "technicalDetails": "The vulnerability originates from improper sanitization and validation of user-supplied input provided via a pagination parameter before it is processed within a SQL query.\nThe affected component fails to utilize prepared statements or appropriate parameterized queries, which would otherwise decouple the data from the executable command logic.\nBy passing malicious SQL syntax through the vulnerable parameter, an attacker can alter the structure of the intended database query, effectively bypassing standard application logic.\nThe attack flow begins when an authenticated administrator interacts with the plugin's interface, triggering a request that includes the insecurely handled pagination parameter.\nBecause the input is concatenated directly into the query, the attacker can leverage techniques such as UNION-based SQL injection to extract sensitive information from other tables in the WordPress database, or error-based injection to infer data structure.\nThe impact is significant, as administrative privileges are a prerequisite; an attacker who has reached this level of access can leverage this SQL injection to perform actions outside the scope of the plugin's intended functionality.\nThis includes, but is not limited to, reading sensitive user credentials, modifying core database records, or escalating privileges further within the WordPress environment.\nThe lack of strict type checking or input whitelisting for the pagination parameter allows the database engine to interpret user input as SQL commands, facilitating the execution of arbitrary queries.\nThis vulnerability persists in all versions of the WPLP Cookie Consent plugin prior to 4.4.2, where remediation was introduced to properly sanitize input data before query execution."
}