CVE-2026-75865

The WPLP Cookie Consent plugin for WordPress, in all versions up to and including 4.4.1, combines missing file type validation in its saas_upload_logo() function with an authorization bypass on the WPLP connector REST endpoints. Because those REST routes require no authentication, an unauthenticated attacker can send a crafted request that uploads an arbitrary file, such as a PHP file, to the affected site's server. Depending on where the file lands and how the server is configured, this can lead to remote code execution and full site compromise, consistent with the 9.8 CVSS score. Any WordPress site running WPLP Cookie Consent version 4.4.1 or earlier is exposed. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and its EPSS of 0.5% (42nd percentile) suggests a low probability of near-term exploitation.

What to do: Update the WPLP Cookie Consent plugin as soon as a patched release beyond 4.4.1 becomes available. Until patched, deactivate the plugin or block unauthenticated access to its connector REST endpoints (e.g., via WAF or server rules restricting REST access), and review the uploads directory and web root for unexpected PHP files that could indicate prior exploitation.