CVE-2025-12136

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This is due to insufficient validation on the user-supplied URL in the '/scanner/scan-without-login' REST API endpoint. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via the `url` parameter.

• CWE-918

• https://infosecstuff.com/SSRF-Real-Cookie-Banner
• https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
• https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L210
• https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L223
• https://plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php#L48
• https://plugins.trac.wordpress.org/changeset/3378727
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7f559d7f-3faf-4549-b529-f4db03dce2dd?source=cve

Published

Oct 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12130The WC Vendors – WooCommerce Multivendor, WooCommerce Market…4.3
• CVE-2025-12131A truncated 802.15.4 packet can lead to an assert, resulting…6.5
• CVE-2025-12132The WP Custom Admin Login Page Logo plugin for WordPress is …4.3
• CVE-2025-12133The EPROLO Dropshipping plugin for WordPress is vulnerable t…4.3
• CVE-2025-12134The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced…5.3
• CVE-2025-12135The WPBookit plugin for WordPress is vulnerable to Stored Cr…7.2
• CVE-2025-12137The Import WP – Export and Import CSV and XML files to WordP…4.9
• CVE-2025-12138The URL Image Importer plugin for WordPress is vulnerable to…8.8
• CVE-2025-12139The File Manager for Google Drive – Integrate Google Drive w…7.5
• CVE-2025-1214A vulnerability classified as critical has been found in pih…8.8
• CVE-2025-12140The application contains an insecure 'redirectToUrl' mechani…9.3
• CVE-2025-12141In Grafana's alerting system, users with edit permissions fo…6.5