{"id":"CVE-2026-82970","aliases":["EUVD-2026-68575","GHSA-835r-3gvv-r7jg"],"status":"published","title":"WordPress WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent plugin \u003c= 4.4.1 - Arbitrary File Upload vulnerability","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent allows Using Malicious Files.\n\nThis issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through 4.4.1.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00522,"percentile":0.44635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-08-31T14:43:38Z","modified":"2026-09-01T20:48:22Z","products":[{"vendor":"wp legal pages","product":"wp cookie notice for gdpr, ccpa \u0026 eprivacy consent"}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-4-1-arbitrary-file-upload-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82970"},{"url":"https://github.com/advisories/GHSA-835r-3gvv-r7jg"}],"sources":{"cve":[{"id":"CVE-2026-82970","title":"WordPress WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent plugin \u003c= 4.4.1 - Arbitrary File Upload vulnerability","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent allows Using Malicious Files.\n\nThis issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through 4.4.1.","status":"published","published":"2026-08-31T14:43:38.358Z","modified":"2026-08-31T18:51:27.733Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-68575","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent allows Using Malicious Files.\n\nThis issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through 4.4.1.","status":"published","published":"2026-08-31T14:43:38Z","modified":"2026-08-31T18:51:27Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:20.215322Z"}],"ghsa":[{"id":"GHSA-835r-3gvv-r7jg","title":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice...","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent allows Using Malicious Files.\n\nThis issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through 4.4.1.","status":"published","published":"2026-08-31T15:34:47Z","modified":"2026-08-31T15:34:51Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:11:11.297642Z"}],"nvd":[{"id":"CVE-2026-82970","description":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent allows Using Malicious Files.\n\nThis issue affects WP Cookie Notice for GDPR, CCPA \u0026 ePrivacy Consent: from n/a through 4.4.1.","status":"published","published":"2026-08-31T15:18:33.01Z","modified":"2026-09-01T20:48:22.513Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:42.691315Z"}]}}