Description

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-31T15:18:33.010Z",
  "pubdate": "2026-08-31T15:18:33.010Z",
  "executiveSummary": "The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin, affecting versions n/a through 4.4.1, is vulnerable to an Unrestricted Upload of File with Dangerous Type.\nThis vulnerability allows an attacker to upload arbitrary files, typically executable scripts, to the web server.\nThe security flaw poses a critical risk to the integrity, availability, and confidentiality of the WordPress installation.\nSuccessful exploitation enables an attacker to achieve Remote Code Execution (RCE) by accessing the uploaded malicious file directly via a web browser.\nThe vulnerability does not inherently require high-level administrative privileges, potentially allowing unauthorized actors to compromise the host environment.\nThe impact includes full site takeover, unauthorized access to sensitive database information, and potential lateral movement within the hosting infrastructure.",
  "technicalDetails": "The vulnerability resides in the file handling mechanism of the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin, specifically within the logic responsible for processing user-supplied file uploads.\nThe core issue is a failure to implement robust server-side validation or sanitization on uploaded content types. The application fails to verify the MIME type or file extension against a strictly enforced allow-list, effectively permitting the upload of arbitrary file extensions such as .php, .phtml, or .php5.\nThe attack flow begins when an attacker identifies the endpoint designated for file uploads within the plugin. Because the application lacks adequate filtering, the attacker can submit a multipart/form-data request containing a malicious payload, such as a web shell.\nOnce the file is successfully uploaded, it is stored within a publicly accessible directory on the WordPress filesystem. The attacker then discovers the path to this file—which is often predictable—and sends an HTTP GET request to the file's URL. When the web server processes this request, the malicious script is executed within the context of the web server process (e.g., www-data).\nThis execution grants the attacker the ability to interact with the server's filesystem, execute shell commands, query the WordPress database, or deploy persistent backdoors. The lack of validation creates a direct pathway for code injection, bypassing any client-side protections that might be present in the user interface.\nAffected versions include all releases from the initial release through 4.4.1. Exploitation is facilitated by the plugin's failure to enforce strict file naming conventions or rename files to non-executable extensions upon reception. Furthermore, the absence of an integration with security mechanisms like .htaccess restrictions or secure directory permissions allows these files to remain functional and reachable by external actors.\nPost-exploitation, the adversary can leverage the server's privileges to escalate their presence, exfiltrate sensitive configuration files (e.g., wp-config.php), or utilize the server as a node in a broader malicious network, significantly degrading the security posture of the entire hosting environment."
}