CVE-2026-65497

Name of the Vulnerable Software and Affected Versions Complianz versions prior to 7.5.2

Description The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress allows authenticated attackers with administrator-level access and above to perform PHP Object Injection. This occurs through the deserialization of untrusted input, a process where a stored string is converted back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the software, the presence of a POP chain in another installed plugin or theme could enable the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to version 7.5.2 or later.