CVE-2026-85131— WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
Quick assessment
Affected
Unknown WPLP Cookie Consent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 WPLP Cookie Consent 在 4.4.4 版本之前，在处理其管理界面中的批量操作时未执行 CSRF（跨站请求伪造）或权限检查，且未将目标对象限制为其自身记录，因此攻击者可通过构造恶意请求，使已登录的管理员永久删除任意文章和页面。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WPLP Cookie Consent | < 4.4.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85131
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WPLP Cookie Consent | 0 ~ 4.4.4 | - |
|
II. Public POCs for CVE-2026-85131
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85131
请登录查看更多情报信息。
Other References for CVE-2026-85131 (1)
-
🔗 WPLP Cookie Consent < 4.4.4 – Arbitrary Post Deletion via CSRF | CVE 2026-85131 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-16 · 46 CVEs total
| CVE-2026-13407 | 6.1 MEDIUM | Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notifica |
| CVE-2026-84906 | 5.3 MEDIUM | Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transa |
| CVE-2026-86475 | 5.3 MEDIUM | Appointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appo |
| CVE-2026-19857 | 4.8 MEDIUM | Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Cu |
| CVE-2026-76552 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Impo | |
| CVE-2026-84907 | Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoi | |
| CVE-2026-76555 | WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File | |
| CVE-2026-76557 | WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options | |
| CVE-2026-76551 | WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function | |
| CVE-2026-74926 | MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via | |
| CVE-2026-76553 | WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template P | |
| CVE-2026-78472 | Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter | |
| CVE-2026-82124 | Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Con | |
| CVE-2026-77702 | Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token | |
| CVE-2026-84829 | Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter | |
| CVE-2026-84905 | Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation | |
| CVE-2026-84088 | Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget | |
| CVE-2026-82126 | Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content D | |
| CVE-2026-82125 | Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Con | |
| CVE-2026-76550 | WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WPLP Cookie Consent
-
CVE-2026-85130
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via -
CVE-2026-85133
WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorizat -
CVE-2026-85132
WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan -
CVE-2026-82184
WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consen -
CVE-2026-82185
WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Ov
Same vendor: Unknown
-
CVE-2026-87831
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-87829
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-91017
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthen -
CVE-2026-86801
To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, Fi -
CVE-2026-87963
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username
V. Comments for CVE-2026-85131
No comments yet