CVE-2026-82970

CriticalCVSS 10.0/10Last modified Sep 1, 2026

Description

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files.

This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
WP Legal PagesWP Cookie Notice for GDPR, CCPA & ePrivacy Consent<= 4.4.1

References

Timeline

Published
Aug 31, 2026
Last modified
Sep 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-8297110.0A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of theCVE-2026-829739.4Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticateCVE-2026-829767.1A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP fCVE-2026-829778.4The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-subCVE-2026-829784.3An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule sCVE-2026-829806.3Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves fCVE-2026-829824.3The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from appCVE-2026-829833.3The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level peCVE-2026-829844.3When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member oCVE-2026-829856.5The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewiCVE-2026-829864.6The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though tCVE-2026-829877.5There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta
CVE-2026-82970: Critical severity, CVSS 10.0 | Vulnix