A critical vulnerability in the WPLP Cookie Consent plugin for WordPress allows unauthenticated attackers to execute arbitrary code on the host server.

The plugin suffers from an unrestricted file upload vulnerability (CWE-434) within the saas_upload_logo function, which is reachable due to an authorization bypass on REST endpoints. This flaw permits unauthenticated attackers to upload malicious files, such as web shells, to the server.

Successful exploitation of this vulnerability results in full server compromise, as the ability to upload arbitrary files typically leads to remote code execution. Given the CVSS score of 9.8, this represents a critical risk to data confidentiality, integrity, and availability. Compromised instances may be used to exfiltrate sensitive user data, host phishing campaigns, or serve as a beachhead for further attacks within the internal network.

Immediate Action: Update the WPLP Cookie Consent plugin to version 4.4.2 or later immediately to resolve the file validation and authorization bypass flaws.

Proactive Monitoring: Review server access logs for suspicious POST requests targeting REST API endpoints, particularly those associated with the plugin, and monitor for the creation of unexpected files in the upload directory.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected REST API endpoints or restrict file uploads for this directory.

Public Exploit Available: Unknown.

The severity of this vulnerability cannot be overstated, as it provides a direct path to remote code execution without requiring any user credentials. IT administrators must prioritize patching this plugin to version 4.4.2 across all WordPress installations. Failure to address this flaw leaves the entire web server environment exposed to total takeover by external attackers.