CVE-2026-12920 describes an SQL Injection vulnerability (CWE-89) in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin. The issue arises from insufficient escaping and lack of proper preparation of the 's' parameter in SQL queries. Authenticated attackers with administrator or higher privileges can exploit this to append malicious SQL commands to existing queries, enabling unauthorized data extraction from the database. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated administrator-level user to perform SQL Injection attacks, potentially extracting sensitive information from the plugin's database. The vulnerability does not impact availability or integrity but compromises confidentiality of data stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the vulnerable versions of the plugin if possible.