Live › vulnerability › CVE-2026-12272
Go to dashboardThe Lightweight Cookie Notice plugin for WordPress hardcodes a publicly known value for the W3TC_DYNAMIC_SECURITY constant, up to and including version 1.19. An unauthenticated attacker can learn the W3 Total Cache mfunc security key and, when W3 Total Cache is also installed, may inject arbitrary PHP code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Lightweight Cookie Notice plugin at version 1.19 or earlier are exposed, and the risk is only real when W3 Total Cache is also installed. Sites without this plugin, or without W3 Total Cache, are unlikely to be exploitable through this flaw. Managed hosts that patch plugins for you still need to confirm the update landed.
No product ranges from the sources yet.
lightweight-cookie-notice (or the plugin named Lightweight Cookie Notice) is installed and its version in the WordPress admin plugins list, or with wp plugin listwp plugin list --status=active1.19; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.
This page as .md · .json · in your agent: get_signal("CVE-2026-12272")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.