CVE-2026-82970: CWE-434 Unrestricted Upload of File with Dangerous Type in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent

This vulnerability, classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), exists in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin. It allows unauthenticated attackers to upload malicious files without restriction, potentially enabling remote code execution or other severe impacts. The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The affected versions include all versions up to 4.4.1. No official patch or remediation guidance has been published yet.

Successful exploitation can lead to full system compromise, including unauthorized disclosure, modification, and destruction of data. The vulnerability allows attackers to upload malicious files that can be executed or used to further compromise the system. Given the critical CVSS score and the nature of the flaw, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict file upload permissions, implement additional file type validation, and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted users or networks if possible.