Attack Chain

1. Attacker identifies a target running WPLP Cookie Consent plugin version 4.4.1 or lower.
2. Attacker probes the REST API endpoints associated with the plugin to locate the vulnerable connector service.
3. Attacker triggers the authorization bypass on the target REST endpoint, gaining unauthorized access to plugin functionality.
4. Attacker sends an HTTP POST request targeting the saas_upload_logo() function.
5. Attacker includes a malicious payload (e.g., a web shell disguised as an image file) in the file upload request.
6. Server fails to validate the file extension or content, saving the payload to a publicly accessible directory.
7. Attacker navigates to the URL of the uploaded file to trigger its execution on the server.
8. Attacker achieves remote code execution for system compromise or further lateral movement.

Impact

Successful exploitation of CVE-2026-75865 allows unauthenticated actors to gain full control over the compromised WordPress server. This can lead to complete site compromise, data exfiltration of customer information, unauthorized site defacement, and the deployment of additional malware or backdoors. Given the ubiquity of cookie consent management plugins, a large number of internet-facing sites may be at risk.

Recommendation

Prioritize the update of the WPLP Cookie Consent plugin to the latest version, ensuring all installations are patched beyond version 4.4.1.

Rules

title: "Detects CVE-2026-75865 Exploitation - Unauthenticated File Upload via WPLP REST API" description: "Detects exploitation attempts by monitoring for POST requests to the plugin's logo upload endpoint. High-risk indicators include requests lacking session headers or containing non-image file extensions." logsource: category: webserver detection: selection: cs-method: "POST" cs-uri-stem|contains: "/wp-json/" cs-uri-query|contains: "saas_upload_logo" filter: cs-uri-query|endswith:

• ".jpg"
• ".jpeg"
• ".png"
• ".gif" condition: selection and not filter level: critical tags:
• attack.initial_access
• attack.execution
• attack.t1190
• attack.t1203 tests: positive:
• name: "Malicious upload to logo endpoint" data:
• cs-method: "POST" cs-uri-stem: "/wp-json/wplp/v1/upload" cs-uri-query: "action=saas_upload_logo&filename=shell.php" negative:
• name: "Legitimate logo upload" data:
• cs-method: "POST" cs-uri-stem: "/wp-json/wplp/v1/upload" cs-uri-query: "action=saas_upload_logo&filename=logo.png" falsepositives:
• "Legitimate administrative file uploads if the webserver path mapping is inconsistent" handoff: detection_confidence: "high" required_telemetry:
• log_source: "webserver" event_or_channel: "access_logs" required_fields:
• "cs-method"
• "cs-uri-stem"
• "cs-uri-query" availability: "available" validation: status: "needs_environment_validation"