CVE-2026-4304 in Cookie Allow Plugin
Summary
by MITRE • 05/05/2026
The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to, and including, 3.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/10/2026
The WeePie Cookie Allow plugin for WordPress presents a critical SQL injection vulnerability that affects all versions through 3.4.11, creating a significant security risk for WordPress installations. This vulnerability stems from inadequate input sanitization and improper query preparation mechanisms within the plugin's codebase, specifically in how it handles the 'consent' parameter. The flaw allows attackers to manipulate database queries through malicious input, bypassing standard security measures that should protect against unauthorized database access.
The technical implementation of this vulnerability occurs when the plugin processes the 'consent' parameter without proper escaping or parameterization before incorporating it into SQL queries. This primitive approach to database interaction creates an opening for attackers to inject malicious SQL code directly into existing queries. The lack of input validation and output escaping means that any user-supplied data can be interpreted as SQL syntax rather than plain text, enabling attackers to execute arbitrary database operations.
The operational impact of this vulnerability extends beyond simple data theft, as unauthenticated attackers can leverage this weakness to extract sensitive information from the WordPress database. This includes but is not limited to user credentials, personal data, configuration settings, and potentially administrative access credentials. The vulnerability's exploitation does not require authentication, making it particularly dangerous as it can be targeted by anyone with access to the affected WordPress site. Attackers can construct malicious payloads that manipulate existing queries to dump database contents, modify records, or even escalate privileges within the WordPress environment.
From a cybersecurity perspective, this vulnerability aligns with CWE-89, which describes improper neutralization of special elements used in an SQL command, and represents a classic example of SQL injection attacks that fall under the ATT&CK technique T1071.004 for application layer protocol. The weakness demonstrates poor secure coding practices and inadequate defense in depth measures within the plugin's architecture. Organizations running vulnerable versions face significant risk of data breaches, regulatory compliance violations, and potential system compromise. The vulnerability's persistence across multiple versions indicates a fundamental flaw in the plugin's development lifecycle, suggesting inadequate security testing and code review processes.
Mitigation strategies should include immediate patching to the latest plugin version where the vulnerability has been addressed, implementing web application firewalls to detect and block malicious SQL injection attempts, and conducting thorough security assessments of all installed WordPress plugins. Database administrators should also implement proper access controls, limit database user privileges, and monitor database logs for suspicious activities. Additionally, organizations should consider implementing input validation at multiple layers and establishing robust patch management procedures to prevent similar vulnerabilities from affecting other components of their WordPress infrastructure.