CVE-2026-12272

5.3 Moyenne

Publiée le 16/10/2026 à 08:17 · Modifiée le 16/10/2026 à 20:17 · Analyse NVD reportée · Source : security@wordfence.com

Description

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.

Traduire en français

Produits concernés

daext Lightweight Cookie Notice – Cookie Banner for Cookie Consent

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-330

Références

https://plugins.trac.wordpress.org/changeset/3584811/lightweight-cookie-notice-free/trunk/public/class-daextlwcnf-public.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/54e53420-aa89-49d6-9632-cba066c46a51?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories