CVE-2025-49993: Cookie-Script.com Auth Bypass Vulnerability

CVE-2025-49993 Overview

CVE-2025-49993 is a missing authorization vulnerability affecting the Cookie-Script.com WordPress plugin developed by csarturas. The flaw exists in versions up to and including 1.2.1 and stems from incorrectly configured access control security levels [CWE-862]. Unauthenticated attackers can send network requests to protected plugin endpoints without meeting authorization requirements. Successful exploitation can result in limited integrity impact on the WordPress site running the affected plugin.

Critical Impact
Unauthenticated network-based attackers can bypass access control checks in the Cookie-Script.com plugin to modify data managed by the plugin, affecting the integrity of WordPress installations that rely on it for cookie consent management.

Affected Products

csarturas Cookie-Script.com WordPress plugin (cookie-script-com)
All versions from initial release through 1.2.1
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-06-20 - CVE-2025-49993 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49993

Vulnerability Analysis

The vulnerability is a broken access control issue in the Cookie-Script.com WordPress plugin. The plugin exposes functionality that should be restricted to authorized users, but fails to enforce capability or nonce checks on those code paths. An unauthenticated attacker can invoke the affected endpoints over the network without user interaction.

The issue is classified under CWE-862 (Missing Authorization). This class of weakness occurs when software does not perform an authorization check when an actor attempts to access a resource or perform an action. In WordPress plugins, this typically manifests as AJAX handlers or REST endpoints that omit current_user_can() verification or check_admin_referer() nonce validation.

The Patchstack advisory categorizes the impact as limited to integrity, with no confidentiality or availability consequences. The EPSS score at time of writing indicates a low probability of exploitation observed in the wild.

Root Cause

The root cause is the absence of authorization checks on plugin functionality that modifies state. Plugin handlers do not verify the calling user's WordPress capabilities before executing privileged actions. Without capability enforcement, any network client can reach handlers intended for administrators.

Attack Vector

An attacker crafts HTTP requests targeting the exposed plugin endpoints on a WordPress site running Cookie-Script.com 1.2.1 or earlier. The request requires no authentication, no user interaction, and low attack complexity. Refer to the Patchstack advisory for the specific vulnerable endpoints and parameters.

Detection Methods for CVE-2025-49993

Indicators of Compromise

Unauthenticated POST requests to admin-ajax.php referencing Cookie-Script.com plugin actions
Unexpected modifications to plugin settings or cookie consent configuration
WordPress access logs showing requests to plugin endpoints from unauthenticated sessions

Detection Strategies

Inventory WordPress installations and identify sites with the cookie-script-com plugin at version 1.2.1 or earlier
Review web server access logs for anomalous traffic patterns targeting plugin AJAX or REST routes
Monitor WordPress option changes and plugin configuration modifications outside expected administrator activity

Monitoring Recommendations

Enable WordPress audit logging to capture settings changes and plugin activity
Correlate web application firewall (WAF) alerts with WordPress admin activity for the affected plugin
Alert on repeated unauthenticated requests to plugin-specific endpoint paths

How to Mitigate CVE-2025-49993

Immediate Actions Required

Identify all WordPress sites running the Cookie-Script.com plugin at version 1.2.1 or earlier
Deactivate the plugin until a patched version is available and deployed
Restrict access to /wp-admin/admin-ajax.php and REST API endpoints for the affected plugin at the WAF layer

Patch Information

No fixed version is documented in the referenced advisory at the time of publication. Monitor the Patchstack WordPress Plugin Vulnerability advisory and the plugin's WordPress.org page for an updated release. Apply the vendor patch as soon as it becomes available.

Workarounds

Deactivate and remove the Cookie-Script.com plugin until a patched release is available
Deploy WAF rules that block unauthenticated requests to the plugin's AJAX and REST endpoints
Replace the plugin with an alternative cookie consent solution that receives active security maintenance

bash

# Example WAF rule concept — block unauthenticated access to plugin AJAX actions
# Adjust action names based on the Patchstack advisory details
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1049993,msg:'Block Cookie-Script.com plugin CVE-2025-49993'"
  SecRule ARGS:action "@rx ^(cookie_script_.*)$" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"