WordPress WeePie Cookie Plugin SQL Injection Flaw

The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to, and including, 3.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WeePie Cookie Allow plugin for WordPress contains a critical SQL injection vulnerability in its 'consent' parameter that affects all versions through 3.4.11. Attackers can exploit insufficient input escaping and improper SQL query preparation to inject malicious SQL commands without requiring authentication. This vulnerability is particularly dangerous because it enables unauthenticated access to extract sensitive database information from WordPress installations, affecting any site using this plugin regardless of user privileges. Organizations relying on this plugin for cookie consent management face immediate risk of data exposure and potential compliance violations.

Casky's skill mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) paired with Claude's extended reasoning capabilities enables practitioners to identify the attack chain behind this vulnerability. When analyzing network traffic or query logs, Casky would detect reconnaissance patterns where attackers probe the 'consent' parameter with SQL metacharacters, followed by information gathering attempts targeting database structure and content. Practitioners using Casky would see flagged findings that correlate suspicious parameter manipulation with database enumeration techniques—such as UNION-based or error-based SQL injection payloads—allowing them to distinguish this specific exploitation pattern from legitimate consent parameter usage. The 301 mapped skills provide comprehensive coverage of related attack techniques, enabling security teams to contextualize this vulnerability within broader threat landscapes and respond with precision.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4304.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-4304

Casky has 301 skills that investigate the attack patterns behind CVE-2026-4304. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn