Server-Side Request Forgery in Real Cookie Banner Plugin for WordPress

CVE-2025-12136

What is CVE-2025-12136?

The Real Cookie Banner plugin for WordPress contains a vulnerability that allows authenticated attackers with administrator access to exploit insufficient URL validation in its '/scanner/scan-without-login' REST API endpoint. This flaw enables attackers to send web requests to unspecified external locations through the application, potentially querying or modifying sensitive information within internal services by manipulating the 'url' parameter. This vulnerability poses a significant risk to websites using the plugin, as it can facilitate unauthorized access to backend resources.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References