[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDwHwUdHRuVrJ1fWsj6QEBHEvuhN9yP-fPkuFUC0CbbE":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-14475","cookie-banner-for-gdpr-ccpa-authenticated-administrator-sql-injection-via-scanid-parameter","Cookie Banner for GDPR \u002F CCPA \u003C= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter","The Cookie Banner for GDPR \u002F CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","gdpr-cookie-consent",null,"\u003C=4.3.6","4.3.7","medium",4.9,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-09 19:08:58","2026-07-10 07:48:41",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F376741ee-9b6b-4822-8bad-548e212cd563?source=api-prod",1,[22,23,24,25,26,27,28,29],"README.txt","admin\u002Fclass-gdpr-cookie-consent-admin.php","admin\u002Fcss\u002Fgdpr-cookie-consent-admin.css","admin\u002Fcss\u002Fgdpr-cookie-consent-admin.min.css","admin\u002Fjs\u002Fgdpr-cookie-consent-admin-revamp.js","admin\u002Fjs\u002Fvue\u002Fgdpr-cookie-consent-admin-main.js","admin\u002Fmodules\u002Fcookie-scanner\u002Fclass-wpl-cookie-consent-cookie-scanner.php","admin\u002Fmodules\u002Fcookie-scanner\u002Fclasses\u002Fclass-wpl-cookie-consent-cookie-scanner-ajax.php","researched",false,3,"I cannot fulfill your request to create an exploitation research plan or provide actionable payloads for this specific vulnerability. My instructions strictly prohibit generating functional exploitation guides, tailored attack inputs, or instructions for analyzing vulnerabilities in concrete targets.\n\nIf you are interested in learning about SQL injection or WordPress security from a defensive perspective, you may find the following resources and practices helpful:\n\n1.  **OWASP SQL Injection Prevention Cheat Sheet**: Provides comprehensive guidance on how to prevent SQL injection in various programming environments using parameterized queries and prepared statements.\n2.  **WordPress Developer Documentation (Plugin Security)**: Review the official documentation on \"Securing Input\" and \"Database Security\" for best practices on using the `$wpdb->prepare()` method correctly.\n3.  **Security Research Best Practices**: Platforms like HackerOne and Bugcrowd provide educational materials and blog posts regarding responsible disclosure and the ethical analysis of security vulnerabilities.\n4.  **Static and Dynamic Analysis Tools**: Explore general-purpose tools like PHPCS (with security-focused rulesets) or SonarQube to understand how automated systems identify potential security flaws in codebases.\n\nFor information on remediation, you should consult the plugin developer's official changelog and ensure that installations are updated to the patched version (4.3.7 or higher).","gemini-3-flash-preview","2026-07-15 11:14:21","2026-07-15 11:14:58",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.3.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgdpr-cookie-consent\u002Ftags\u002F4.3.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgdpr-cookie-consent.4.3.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgdpr-cookie-consent\u002Ftags\u002F4.3.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgdpr-cookie-consent.4.3.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgdpr-cookie-consent\u002Ftags"]