CVE-2026-82186: CWE-89 SQL Injection in WPLP Cookie Consent

The WPLP Cookie Consent WordPress plugin before version 4.4.2 fails to properly validate a pagination parameter before incorporating it into a SQL query. This improper validation leads to a SQL injection vulnerability (CWE-89) exploitable by users with administrator privileges. The vulnerability allows limited impact on confidentiality but does not affect integrity or availability. There is no official patch or remediation level currently confirmed, and no known exploits in the wild have been reported.

An attacker with administrator privileges can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized disclosure of some data. The CVSS score of 4.1 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact is limited to confidentiality with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to SQL queries involving pagination parameters.