Unauthenticated arbitrary file upload in WP Cookie Notice GDPR consent plugin (CVE-2026-82970)
VulnCheck added this flaw to its known-exploited catalog on 2026-08-31 on the back of Patchstack's exploitation report, and any site still running the plugin at 4.4.1 or below is exposed to unauthenticated webshell uploads.
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions up to and including 4.4.1) allows unauthenticated upload of files with dangerous types, which on a WordPress site translates directly to remote code execution via a planted PHP file. The CVSS 10.0 vector requires no privileges and no user interaction.
Affected: WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.1
How to Test
Check the installed plugin version in the WordPress admin (the plugin slug is gdpr-cookie-consent) and confirm whether it is 4.4.1 or lower; review wp-content/uploads and other writable directories for unexpected PHP or executable files, and inspect web server access logs for anomalous unauthenticated POST requests hitting the plugin's upload handling.
How to Mitigate
No fixed release is cited in the available evidence for versions through 4.4.1, so deactivate and remove the plugin until the vendor ships an update above 4.4.1; Patchstack offers a virtual-patch mitigation for subscribers. If a compromise indicator is found, treat the site as breached and rotate credentials.the plugin should only be re-enabled once a fixed version is confirmed.