{"id":"CVE-2026-85131","state":"PUBLISHED","title":"WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF","description":"The WPLP Cookie Consent  WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.","publishedAt":"2026-09-16T06:00:13.962Z","updatedAt":"2026-09-17T12:36:49.613Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown WPLP Cookie Consent"],"affected":[{"vendor":"Unknown","product":"WPLP Cookie Consent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.4.4","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/5a94c9c8-5b30-4735-be6b-ced53ff587bc/"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/85xxx/CVE-2026-85131.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-85131","state":"PUBLISHED","datePublished":"2026-09-16T06:00:13.962Z","dateUpdated":"2026-09-17T12:36:49.613Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-09-03T08:39:08.873Z"},"containers":{"cna":{"title":"WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF","descriptions":[{"lang":"en","value":"The WPLP Cookie Consent  WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request."}],"affected":[{"vendor":"Unknown","product":"WPLP Cookie Consent","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.4.4","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5a94c9c8-5b30-4735-be6b-ced53ff587bc/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-16T06:00:13.962Z"},"credits":[{"lang":"en","value":"Karthik Ramakrishnan","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-17T12:19:36.574145Z","id":"CVE-2026-85131","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","type":"CWE","lang":"en","description":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-17T12:36:49.613Z"}}]}}}