Read the docs
TI-2026-75197 Aliases CVE-2026-12272GHSA-phxf-4j8m-r2jf

Sensitive information exposure in Lightweight Cookie Notice plugin

Priority LOW 29CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Lightweight Cookie Notice (Cookie Banner for Cookie Consent) plugin for WordPress is affected in all versions up to and including 1.19. The W3TC_DYNAMIC_SECURITY constant is hardcoded to a publicly known value, which exposes the W3 Total Cache mfunc security key (CWE-330). An unauthenticated remote attacker can learn that key, and when W3 Total Cache is installed this may allow arbitrary PHP code injection.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DAEXTLightweight Cookie Notice – Cookie Banner for Cookie Consentup to 1.19—No fix listedCNA
  • Lightweight Cookie Notice – Cookie Banner for Cookie Consent VendorDAEXT Affected up to 1.19 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Lightweight Cookie Notice (Cookie Banner for Cookie Consent).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-12272
  2. 2026-10-16 Alias added: GHSA-phxf-4j8m-r2jf
  3. 2026-10-16 CISA SSVC decision points changed

References

Other 2

  • TI-2023-26197 WordPress League Table Plugin <= 1.13 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-25127 WordPress Autolinks Manager Plugin <= 1.10.04 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-22094 WordPress Live News Plugin <= 1.06 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2025-30091 WordPress Soccer Live Scores <= 1.0.5 - Cross Site Request Forgery (CSRF) Vulnerability CVSS 3.1MEDIUM 4.3
  • TI-2024-04015 Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences