CVE-2025-12136 Overview
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 5.2.4. The flaw resides in the /scanner/scan-without-login REST API endpoint, which fails to validate user-supplied URLs. Authenticated attackers with administrator-level access can force the web application to issue arbitrary outbound requests. Attackers can use this behavior to query internal services, read metadata endpoints, or interact with resources reachable only from the server. The issue is tracked under CWE-918.
Critical Impact
Authenticated administrators can pivot from the WordPress host to internal network services, exposing cloud metadata, intranet applications, and non-public HTTP resources.
Affected Products
- Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress (all versions ≤ 5.2.4)
- WordPress installations with the vulnerable plugin activated
- Environments where administrator accounts are shared, delegated, or accessible via credential compromise
Discovery Timeline
- 2025-10-24 - CVE-2025-12136 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12136
Vulnerability Analysis
The Real Cookie Banner plugin exposes a scanner feature that fetches remote pages to detect cookies and tracking technologies. The /scanner/scan-without-login REST route accepts a url parameter and issues an HTTP request from the WordPress server to that address. The plugin does not restrict the destination to external, public endpoints. An authenticated administrator can supply URLs pointing at internal IP ranges such as 127.0.0.1, 169.254.169.254, or private RFC1918 hosts. The server retrieves the response and can return content or state information back to the caller, enabling reconnaissance and interaction with services that trust the local network origin.
Root Cause
The root cause is insufficient validation of the url parameter accepted by the scanner endpoint. The plugin resolves and requests any host supplied by the administrator without an allowlist, IP resolution check, or scheme restriction. Relevant handler logic is documented in the plugin source at Scanner.php line 48, line 210, and line 223.
Attack Vector
Exploitation requires authenticated access at administrator privilege or higher. The attacker sends a REST request to /wp-json/real-cookie-banner/v1/scanner/scan-without-login with the url parameter set to an internal target. The WordPress server issues the outbound request and processes the response. Attackers commonly target cloud instance metadata services, internal admin panels, databases exposed on localhost, and other network-bound services. See the OWASP SSRF reference for background on this class of attack.
Detection Methods for CVE-2025-12136
Indicators of Compromise
- REST API requests targeting /wp-json/real-cookie-banner/v1/scanner/scan-without-login with url parameters referencing internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254)
- Outbound HTTP requests originating from the WordPress host to non-public destinations without a corresponding user browsing session
- Unexpected access attempts against cloud metadata endpoints (AWS, Azure, GCP) from the web server host
Detection Strategies
- Inspect WordPress access logs for POST or GET requests to the scanner endpoint containing suspicious URL values
- Correlate plugin scan activity with the authenticated administrator account performing the request and flag anomalous scan patterns
- Alert on egress traffic from web servers destined for RFC1918 ranges or link-local metadata addresses
Monitoring Recommendations
- Enable WordPress audit logging to capture REST API calls and record the requesting user for each scan
- Configure web application firewall rules to log scanner endpoint invocations and parameter contents
- Monitor DNS resolutions initiated by the web server for hostnames that resolve to internal IP space
How to Mitigate CVE-2025-12136
Immediate Actions Required
- Update the Real Cookie Banner plugin to the version released in changeset 3378727 or later
- Audit administrator accounts and rotate credentials for any account that could reach the scanner endpoint
- Restrict egress network access from the WordPress server to the internet only, blocking internal ranges and cloud metadata endpoints
Patch Information
The vendor addressed the SSRF in a patched release tracked in the WordPress plugin repository. Details of the code fix are available in the Wordfence vulnerability report and the corresponding WordPress plugin changeset. Site operators should upgrade beyond version 5.2.4.
Workarounds
- Disable or remove the Real Cookie Banner plugin until the patched version is deployed
- Enforce network egress controls that block requests from the web tier to internal IP ranges and instance metadata services (for example, IMDSv2 with hop limit 1 on AWS)
- Limit the number of administrator accounts and require multi-factor authentication to reduce the exploit surface
# Example nginx egress restriction for the WordPress upstream host
# Deny outbound proxying to private ranges via a filtering forward proxy
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
