CVE-2026-14475— Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wplegalpages | Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | ≤ 4.3.6 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14475
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress WPLP Cookie Consent SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WP Legal Pages Cookie Banner for GDPR / CCPA – WPLP Cookie Consent是WP Legal Pages公司的一款用于GDPR/CCPA合规的Cookie同意横幅插件。 WordPress WPLP Cookie Consent 4.3.6及之前版本存在SQL注入漏洞，该漏洞源于对用户提供的'scan_id'参数转义不足以及现有SQL查询准备不足，容易受到SQL注入攻击，可能使具有管理员级别及更高权限的已验证攻击者提取数据库中敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wplegalpages | Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | 0 ~ 4.3.6 | - |
II. Public POCs for CVE-2026-14475
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14475
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14475 (1)
IV. Related Vulnerabilities
Same product: Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
- CVE-2026-12955
Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorizati - CVE-2026-12920
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Admi - CVE-2025-11754
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, - CVE-2025-14061
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, - CVE-2024-11724
Cookie Consent for WP – Cookie Consent, Consent Log, Cookie
Same vendor: wplegalpages
- CVE-2026-12955
Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorizati - CVE-2026-12920
Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Admi - CVE-2025-11754
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, - CVE-2025-14061
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, - CVE-2025-11816
Privacy Policy Generator, Terms & Conditions Generator WordP
Same weakness: CWE-89
- CVE-2026-65707
Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount - CVE-2026-15663
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL I - CVE-2026-16765
CodeAstro Online Classroom loginlinkadmin.php sql injection - CVE-2026-63359
Appriss Insights VINE SQLI - CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL inje
V. Comments for CVE-2026-14475
No comments yet