CVE-2026-15136 is a CSRF vulnerability in the WPLP Cookie Consent WordPress plugin affecting all versions up to 4.3.7. The issue is caused by missing or incorrect nonce validation in the process_bulk_action function, which handles bulk actions on GDPR data request records. An attacker can exploit this by crafting a malicious request that, when executed by an authenticated site administrator (e.g., by clicking a link), results in permanent deletion or forced resolution of arbitrary GDPR data request records in the wpl_data_req database table. This vulnerability does not require privileges or direct user interaction beyond the administrator being tricked into clicking a link.

The vulnerability allows an unauthenticated attacker to cause an authenticated site administrator to perform unintended actions, specifically the permanent deletion or forced resolution of GDPR data request records. This can lead to loss or manipulation of compliance-related data, potentially impacting data privacy management and regulatory adherence. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider implementing additional CSRF protections or nonce validation manually if feasible. Monitor official vendor channels for updates regarding a patch or official mitigation.