{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-75865/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wordpress:wplp_cookie_consent_cookie_banner_consent_management_for_gdpr_ccpa_google_consent_mode:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-75865"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPLP Cookie Consent – Cookie Banner \u0026 Consent Management for GDPR, CCPA \u0026 Google Consent Mode (\u003c= 4.4.1)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","remote-code-execution","cve-2026-75865"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe WPLP Cookie Consent - Cookie Banner \u0026amp; Consent Management for GDPR, CCPA \u0026amp; Google Consent Mode plugin for WordPress (versions 4.4.1 and earlier) contains a critical security flaw allowing unauthenticated remote code execution (RCE). The vulnerability stems from a broken access control mechanism on the plugin's REST API connector endpoints, coupled with a lack of input validation within the saas_upload_logo() function. By bypassing authentication, an attacker can invoke the logo upload functionality to transmit arbitrary files, such as malicious PHP scripts, directly to the web server's filesystem. Once uploaded, these files can be executed by navigating to the file path, granting the attacker a persistent foothold on the affected WordPress site.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running WPLP Cookie Consent plugin version 4.4.1 or lower.\u003c/li\u003e\n\u003cli\u003eAttacker probes the REST API endpoints associated with the plugin to locate the vulnerable connector service.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the authorization bypass on the target REST endpoint, gaining unauthorized access to plugin functionality.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request targeting the saas_upload_logo() function.\u003c/li\u003e\n\u003cli\u003eAttacker includes a malicious payload (e.g., a web shell disguised as an image file) in the file upload request.\u003c/li\u003e\n\u003cli\u003eServer fails to validate the file extension or content, saving the payload to a publicly accessible directory.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the URL of the uploaded file to trigger its execution on the server.\u003c/li\u003e\n\u003cli\u003eAttacker achieves remote code execution for system compromise or further lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-75865 allows unauthenticated actors to gain full control over the compromised WordPress server. This can lead to complete site compromise, data exfiltration of customer information, unauthorized site defacement, and the deployment of additional malware or backdoors. Given the ubiquity of cookie consent management plugins, a large number of internet-facing sites may be at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the update of the WPLP Cookie Consent plugin to the latest version, ensuring all installations are patched beyond version 4.4.1.\u003c/p\u003e\n\u003ch2 id=\"rules\"\u003eRules\u003c/h2\u003e\n\u003cp\u003etitle: \u0026quot;Detects CVE-2026-75865 Exploitation - Unauthenticated File Upload via WPLP REST API\u0026quot;\ndescription: \u0026quot;Detects exploitation attempts by monitoring for POST requests to the plugin's logo upload endpoint. High-risk indicators include requests lacking session headers or containing non-image file extensions.\u0026quot;\nlogsource:\ncategory: webserver\ndetection:\nselection:\ncs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem|contains: \u0026quot;/wp-json/\u0026quot;\ncs-uri-query|contains: \u0026quot;saas_upload_logo\u0026quot;\nfilter:\ncs-uri-query|endswith:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u0026quot;.jpg\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;.jpeg\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;.png\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;.gif\u0026quot;\ncondition: selection and not filter\nlevel: critical\ntags:\u003c/li\u003e\n\u003cli\u003eattack.initial_access\u003c/li\u003e\n\u003cli\u003eattack.execution\u003c/li\u003e\n\u003cli\u003eattack.t1190\u003c/li\u003e\n\u003cli\u003eattack.t1203\ntests:\npositive:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Malicious upload to logo endpoint\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem: \u0026quot;/wp-json/wplp/v1/upload\u0026quot;\ncs-uri-query: \u0026quot;action=saas_upload_logo\u0026amp;filename=shell.php\u0026quot;\nnegative:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Legitimate logo upload\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem: \u0026quot;/wp-json/wplp/v1/upload\u0026quot;\ncs-uri-query: \u0026quot;action=saas_upload_logo\u0026amp;filename=logo.png\u0026quot;\nfalsepositives:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Legitimate administrative file uploads if the webserver path mapping is inconsistent\u0026quot;\nhandoff:\ndetection_confidence: \u0026quot;high\u0026quot;\nrequired_telemetry:\u003c/li\u003e\n\u003cli\u003elog_source: \u0026quot;webserver\u0026quot;\nevent_or_channel: \u0026quot;access_logs\u0026quot;\nrequired_fields:\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-method\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-stem\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-query\u0026quot;\navailability: \u0026quot;available\u0026quot;\nvalidation:\nstatus: \u0026quot;needs_environment_validation\u0026quot;\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-01T05:02:26Z","date_published":"2026-09-01T05:02:26Z","id":"https://feed.craftedsignal.io/briefs/2026-09-wplp-cookie-consent-rce/","summary":"The WPLP Cookie Consent WordPress plugin is vulnerable to unauthenticated arbitrary file upload due to improper authorization and missing file type validation, enabling remote code execution.","title":"Unauthenticated Remote Code Execution in WPLP Cookie Consent Plugin","url":"https://feed.craftedsignal.io/briefs/2026-09-wplp-cookie-consent-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-75865","version":"https://jsonfeed.org/version/1.1"}