CVE-2025-51529
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service through database resource exhaustion in the jonkastonka Cookies and Content Security Policy plugin. Attackers can send unlimited database write operations to an AJAX endpoint without authentication, affecting WordPress sites using vulnerable plugin versions up to 2.29.
💻 Affected Systems
- jonkastonka Cookies and Content Security Policy plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database server exhaustion leading to service unavailability, potential data corruption, and extended downtime requiring database recovery.
Likely Case
Degraded database performance, increased latency for legitimate users, and potential temporary service disruption until attack traffic stops.
If Mitigated
Minimal impact with proper rate limiting, database connection limits, and monitoring in place to detect and block excessive requests.
🎯 Exploit Status
Exploit code is publicly available on GitHub, making this easily exploitable by attackers with basic scripting knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2.30 or later
Vendor Advisory: http://cookies.com
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Cookies and Content Security Policy' plugin
4. Click 'Update Now' if update is available
5. Alternatively, download version 2.30+ from WordPress repository and replace plugin files
🔧 Temporary Workarounds
Block vulnerable endpoint via .htaccess
ApachePrevent access to the vulnerable AJAX endpoint at web server level
RewriteEngine On
RewriteRule ^wp-admin/admin-ajax\.php\?action=cacsp_insert_consent_data - [F,L]
Implement rate limiting
allAdd rate limiting for AJAX requests at web server or application firewall level
🧯 If You Can't Patch
- Temporarily disable the plugin if not critically needed
- Implement WAF rules to block requests to wp_ajax_nopriv_cacsp_insert_consent_data endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Cookies and Content Security Policy' version 2.29 or earlierCheck Version:
wp plugin list --name='Cookies and Content Security Policy' --field=versionVerify Fix Applied:
Confirm plugin version is 2.30 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- High frequency of POST requests to /wp-admin/admin-ajax.php with action=cacsp_insert_consent_data
- Database connection errors or slow query logs showing excessive writes
Network Indicators:
- Unusually high traffic to WordPress AJAX endpoints from single or multiple sources
- Pattern of repeated identical POST requests
SIEM Query:
source="web_server" AND uri_path="/wp-admin/admin-ajax.php" AND query_string="*action=cacsp_insert_consent_data*" | stats count by src_ip