CVE case study
CVE-2026-82186: Admin+ SQL Injection in WPLP Cookie Consent via the offset Parameter
The WPLP Cookie Consent WordPress plugin before 4.4.2 did not validate the offset pagination parameter before using it in a SQL query, so an administrator could inject SQL through that parameter. Version 4.4.2 validates the parameter.
- Weakness
- CWE-89
- Affected
- WPLP Cookie Consent (gdpr-cookie-consent) before 4.4.2
- Remediation state
- Upgrade to WPLP Cookie Consent 4.4.2 or later
- Advisory published
- 2 Sep 2026
Why it matters
WPLP Cookie Consent (the gdpr-cookie-consent plugin) is a widely installed WordPress consent-management plugin. In versions before 4.4.2, one of its admin pagination paths placed the user-supplied offset parameter into a SQL query without validating it, so an administrator could inject SQL through that parameter.
The public record scores the issue Medium at 4.1 because it requires an administrator account, which limits who can reach it. On multi-admin or agency-managed sites, though, it still lets a lower-trust administrator read or alter database contents beyond the plugin's intended queries. Version 4.4.2 validates the offset parameter before it reaches the query; WPScan is holding the detailed proof of concept for a coordinated disclosure window so sites can update first.