CVE-2026-12272: CWE-330 Use of Insufficiently Random Values in daext Lightweight Cookie Notice – Cookie Banner for Cookie Consent

CVE-2026-12272 describes a sensitive information exposure vulnerability in the Lightweight Cookie Notice – Cookie Banner for Cookie Consent WordPress plugin (versions up to and including 1.19). The issue arises because the W3TC_DYNAMIC_SECURITY constant is hardcoded to a value that is publicly known. This constant is used as the security key for W3 Total Cache's mfunc feature. If W3 Total Cache is installed alongside this plugin, an attacker can leverage knowledge of this key to perform arbitrary PHP code injection. The CVSS v3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthenticated remote attackers to gain knowledge of the W3 Total Cache mfunc security key due to the hardcoded constant. This can lead to arbitrary PHP code injection when W3 Total Cache is installed, potentially compromising the affected WordPress site. The confidentiality impact is limited, and there is no direct integrity or availability impact reported.

No official patch or remediation is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the Lightweight Cookie Notice plugin or W3 Total Cache plugin to mitigate risk, or apply custom mitigations to prevent exposure of the W3TC_DYNAMIC_SECURITY constant.