---
id: "CVE-2026-12272"
kind: "vulnerability"
aliases: ["CVE-2026-12272"]
title: "WordPress cookie banner plugin leaks a hardcoded key enabling PHP injection"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["plugin-above-1.19", "plugin-not-installed", "w3-total-cache-not-installed"]
published_at: "2026-10-16T06:17:09+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12272", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress cookie banner plugin leaks a hardcoded key enabling PHP injection

The Lightweight Cookie Notice plugin for WordPress hardcodes a publicly known value for the W3TC_DYNAMIC_SECURITY constant, up to and including version 1.19. An unauthenticated attacker can learn the W3 Total Cache mfunc security key and, when W3 Total Cache is also installed, may inject arbitrary PHP code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the plugin `lightweight-cookie-notice` (or the plugin named Lightweight Cookie Notice) is installed and its version in the WordPress admin plugins list, or with `wp plugin list`
- Check whether W3 Total Cache is also installed and active with `wp plugin list --status=active`

## Fix

- Update the Lightweight Cookie Notice plugin to a version later than `1.19`; the fixed version is unknown from the sources
- If no fixed version is available, deactivate the plugin or remove W3 Total Cache while the plugin stays on the site

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12272

## From the sources

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated attackers to know the W3 Total Cache mfunc security key, which when W3 Total Cache is installed may allow arbitrary PHP code injection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_