CVE-2026-14475 wplegalpages CVE debrief

Who should care

Administrators and users of WordPress sites utilizing the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin, especially those with administrator-level access, should be aware of this vulnerability and take immediate action to protect their sites.

Technical summary

The vulnerability exists due to insufficient escaping on the user-supplied 'scan_id' parameter and a lack of sufficient preparation on the existing SQL query. This allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or manipulation. The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.3.6. This vulnerability allows authenticated attackers, with administrator-level access and above, to append additional SQL queries into existing queries, potentially leading to sensitive information extraction from the database. The issue arises from the plugin's failure to properly sanitize user input, making it possible for attackers to exploit this weakness.

Defensive priority

High priority should be given to updating the plugin to a patched version, restricting access to the plugin's functionality, and monitoring for suspicious database queries.

Recommended defensive actions

• Update the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin to a version beyond 4.3.6.
• Restrict access to the plugin's functionality to only necessary personnel.
• Monitor database queries for suspicious activity.
• Implement additional security measures such as web application firewalls (WAFs) to detect and prevent SQL injection attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-10T09:16:53.127Z and was last modified on 2026-07-10T12:16:31.943Z. The vulnerability was reported by [email protected]. Evidence of the vulnerability's existence is based on the CVE record and NVD detail page. The CVE record and NVD detail provide information on the vulnerability's severity and potential impact. Additional information may be available through further research and analysis of the vulnerable code.

Official resources