CVE-2026-12272

Name of the Vulnerable Software and Affected Versions Lightweight Cookie Notice – Cookie Banner for Cookie Consent versions prior to 1.20

Description Sensitive information exposure occurs because the W3TC DYNAMIC SECURITY constant is hardcoded to a publicly known value. This allows unauthenticated attackers to obtain the W3 Total Cache mfunc security key. If W3 Total Cache is also installed, this exposure may enable arbitrary PHP code injection, which is the execution of unauthorized PHP scripts on the server.

Recommendations Update the plugin to a version newer than 1.19.