CVE-2025-12136

🗓️ 24 Oct 2025 09:23:30Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 34 Views🌐 WEB

Authenticated admins can trigger server side request forgery in Real Cookie Banner up to version 5.2.4 via /scanner/scan-without-login to access internal services.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12136	24 Oct 202512:56	–	circl
CNNVD	WordPress plugin Real Cookie Banner 代码问题漏洞	25 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-12136 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint	24 Oct 202509:23	–	cvelist
EUVD	EUVD-2025-35827	24 Oct 202509:23	–	euvd
NVD	CVE-2025-12136	24 Oct 202510:15	–	nvd
Patchstack	WordPress Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint vulnerability	23 Oct 202522:57	–	patchstack
Positive Technologies	PT-2025-43606	24 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12136	25 Oct 202509:33	–	redhatcve
Vulnrichment	CVE-2025-12136 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint	24 Oct 202509:23	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (October 20, 2025 to October 26, 2025)	30 Oct 202516:01	–	wordfence

Vulners

Node

devowl real_cookie_banner:_gdpr_&_eprivacy_cookie_consentRange≤5.2.4wordpress

[
  {
    "vendor": "devowl",
    "product": "Real Cookie Banner: GDPR & ePrivacy Cookie Consent",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.2.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
owasp	www.owasp.org/www-community/attacks/Server_Side_Request_Forgery
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/7f559d7f-3faf-4549-b529-f4db03dce2dd
plugins	www.plugins.trac.wordpress.org/changeset/3378727
plugins	www.plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php
plugins	www.plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php
infosecstuff	www.infosecstuff.com/SSRF-Real-Cookie-Banner
plugins	www.plugins.trac.wordpress.org/browser/real-cookie-banner/trunk/inc/rest/Scanner.php

Parameter	Position	Path	Description	CWE
url	request body	/scanner/scan-without-login	Server-Side Request Forgery via user-supplied URL parameter in the /scanner/scan-without-login REST endpoint enabling authenticated attackers to make web requests to arbitrary locations and access/modify internal services.	CWE-918

17 Jun 2026 08:31Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.16.8

EPSS0.00366

SSVC

CWE-918