Attack Chain

1. Attacker identifies a WordPress site running an outdated version (<= 4.3.5) of the WPLP Cookie Consent plugin.
2. For authenticated exploitation, the attacker logs in as a low-privilege user (Subscriber).
3. The attacker sends a crafted AJAX request to the vulnerable plugin handler, targeting the 'regionArray' parameter.
4. The plugin fails to validate the request origin (no nonce) or user permissions (no capability check).
5. The malicious script is saved into the database as part of the plugin configuration.
6. The attacker waits for a high-privilege user or administrator to navigate to a page where the cookie banner is rendered.
7. The victim's browser fetches the malicious script from the database and renders it, leading to arbitrary JavaScript execution in the victim's session.

Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser session. This can lead to the exfiltration of session cookies, administrative actions taken without user consent, or the redirection of users to malicious websites. As the plugin is used for GDPR and CCPA compliance, it is widely deployed on public-facing websites, increasing the potential impact to both site administrators and site visitors.

Recommendation

Prioritized actions for security teams:

• Update the Cookie Banner for GDPR / CCPA - WPLP Cookie Consent plugin to the latest patched version immediately.
• Review WordPress application logs for unusual AJAX requests targeting plugin settings or the 'regionArray' parameter.
• If immediate patching is not possible, disable the 'Support Google Consent Mode (GCM)' setting in the plugin configuration as a temporary mitigation.
• Monitor for unauthorized administrative actions originating from low-privilege (Subscriber) accounts.