CVE-2026-15136

Name of the Vulnerable Software and Affected Versions Cookie Banner for GDPR / CCPA – WPLP Cookie Consent versions prior to 4.3.8

Description This issue is a Cross-Site Request Forgery (CSRF), which occurs when a malicious website causes a user's web browser to perform an unwanted action on a different website. The flaw exists due to missing or incorrect nonce validation in the process bulk action() function. This allows unauthenticated attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl data req table by tricking a site administrator into clicking a forged link.

Recommendations Update to a version newer than 4.3.7. As a temporary workaround, restrict administrative access to the plugin settings to minimize the risk of exploitation.