Server-Side Request Forgery in Real Cookie Banner Plugin for WordPress

CVE-2025-12136

What is CVE-2025-12136?

The Real Cookie Banner plugin for WordPress contains a vulnerability that allows authenticated attackers with administrator access to exploit insufficient URL validation in its '/scanner/scan-without-login' REST API endpoint. This flaw enables attackers to send web requests to unspecified external locations through the application, potentially querying or modifying sensitive information within internal services by manipulating the 'url' parameter. This vulnerability poses a significant risk to websites using the plugin, as it can facilitate unauthorized access to backend resources.

References