CVE-2026-82185 is a missing authorization vulnerability (CWE-862) in the WPLP Cookie Consent WordPress plugin versions prior to 4.4.2. The plugin fails to enforce capability or nonce checks on some A/B testing actions, enabling any authenticated user to modify global cookie banner settings and reset A/B test data. This flaw affects version 3.6.5 as explicitly stated. No CVSS score or official remediation level is provided, and no patch link is available in the provided data.

An attacker with any authenticated user account, including low-privilege roles such as subscribers, can manipulate the cookie banner configuration for all site visitors and permanently reset A/B test results. This could disrupt user experience and site analytics related to cookie consent but does not indicate direct code execution or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict authenticated user roles to trusted users only and consider disabling A/B testing features if feasible.