CVE-2026-14475 is an SQL Injection vulnerability in the Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin. The issue arises from improper neutralization of special elements in the 'scan_id' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated users with administrator privileges can exploit this to append malicious SQL commands to existing queries, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 4.3.6. No official fix or patch has been documented as of the published date.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks, allowing unauthorized extraction of sensitive information from the database. The vulnerability does not impact availability or integrity according to the CVSS vector, but it compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'scan_id' parameter. Avoid exposing this plugin on publicly accessible environments without proper access controls.