{"id":"CVE-2026-12272","kind":"vulnerability","aliases":["CVE-2026-12272"],"related":[],"title":"WordPress cookie banner plugin leaks a hardcoded key enabling PHP injection","description":"The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.","summary":"The Lightweight Cookie Notice plugin for WordPress hardcodes a publicly known value for the W3TC_DYNAMIC_SECURITY constant, up to and including version 1.19. An unauthenticated attacker can learn the W3 Total Cache mfunc security key and, when W3 Total Cache is also installed, may inject arbitrary PHP code.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["plugin-above-1.19","plugin-not-installed","w3-total-cache-not-installed"],"how_to_check":"- Check whether the plugin `lightweight-cookie-notice` (or the plugin named Lightweight Cookie Notice) is installed and its version in the WordPress admin plugins list, or with `wp plugin list`\n- Check whether W3 Total Cache is also installed and active with `wp plugin list --status=active`","fix":"- Update the Lightweight Cookie Notice plugin to a version later than `1.19`; the fixed version is unknown from the sources\n- If no fixed version is available, deactivate the plugin or remove W3 Total Cache while the plugin stays on the site","status":"open","published_at":"2026-10-16T06:17:09+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:39+00:00","updated_at":"2026-10-25T04:28:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:28:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Lightweight Cookie Notice plugin to a version later than `1.19`; the fixed version is unknown from the sources\n- If no fixed version is available, deactivate the plugin or remove W3 Total Cache while the plugin stays on the site","reach":"internet","title":"WordPress cookie banner plugin leaks a hardcoded key enabling PHP injection","impact":"high","summary":"The Lightweight Cookie Notice plugin for WordPress hardcodes a publicly known value for the W3TC_DYNAMIC_SECURITY constant, up to and including version 1.19. An unauthenticated attacker can learn the W3 Total Cache mfunc security key and, when W3 Total Cache is also installed, may inject arbitrary PHP code.","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary PHP code on the WordPress server","analyst_note":"Confirm the fixed plugin version and whether W3 Total Cache is required for exploitation; check the NVD entry and plugin changelog.","how_to_check":"- Check whether the plugin `lightweight-cookie-notice` (or the plugin named Lightweight Cookie Notice) is installed and its version in the WordPress admin plugins list, or with `wp plugin list`\n- Check whether W3 Total Cache is also installed and active with `wp plugin list --status=active`","needs_analyst":true,"not_affected_if":["plugin-not-installed","w3-total-cache-not-installed","plugin-above-1.19"],"who_is_affected":"Sites running the Lightweight Cookie Notice plugin at version 1.19 or earlier are exposed, and the risk is only real when W3 Total Cache is also installed. Sites without this plugin, or without W3 Total Cache, are unlikely to be exploitable through this flaw. Managed hosts that patch plugins for you still need to confirm the update landed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":3401,"output_tokens":729,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12272':14A,17A '-2026':13A,16A '1.19':47B,98C 'allow':139C 'also':66B 'arbitrari':70B,140C 'attack':50B,121C 'banner':3A,78C 'cach':56B,64B,127C,135C 'code':72B,142C 'consent':81C 'constant':41B,107C 'cooki':2A,26B,75C,77C,80C 'cve':12A,15A 'due':101C 'dynam':39B,105C 'enabl':9A 'exposur':90C 'hardcod':7A,31B,109C 'host':22B 'includ':45B,97C 'inform':89C 'inject':11A,69B,143C 'instal':67B,137C 'key':8A,59B,130C 'know':123C 'known':34B,113C 'leak':5A 'learn':52B 'lightweight':25B,74C 'make':116C 'may':68B,138C 'mfunc':57B,128C 'notic':27B,76C 'packag':18B 'php':10A,19B,71B,141C 'plugin':4A,28B,82C 'possibl':118C 'public':33B,112C 'secur':40B,58B,106C,129C 'self':21B 'self-host':20B 'sensit':88C 'total':55B,63B,126C,134C 'unauthent':49B,120C 'valu':35B,114C 'version':46B,93C 'vulner':86C 'w3':54B,62B,125C,133C 'w3tc':38B,104C 'wordpress':1A,23B,30B,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Lightweight Cookie Notice plugin at version 1.19 or earlier are exposed, and the risk is only real when W3 Total Cache is also installed. Sites without this plugin, or without W3 Total Cache, are unlikely to be exploitable through this flaw. Managed hosts that patch plugins for you still need to confirm the update landed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12272","severity":null,"published_at":"2026-10-16T06:17:09+00:00","modified_at":"2026-10-16T18:17:57+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}