Real Cookie Banner CVE-2025-12136

Requires an authenticated session with administrator-level privileges or above on the target WordPress site (PR:H), and the vulnerable Real Cookie Banner plugin version ≤ 5.2.4 installed and active. The attack specifically targets the '/scanner/scan-without-login' REST API endpoint, abusing insufficient validation of the user-supplied 'url' parameter. The primary limiting factor is the administrator privilege requirement, which confines the threat to trusted operators or attackers who have already achieved admin compromise; realistic impact further depends on the presence of reachable, sensitive internal services (e.g., cloud metadata, internal APIs) from the web server's network position. No end-user interaction is required.

This is a genuinely moderate, not high-priority, issue. The CVSS 3.1 base vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, score 6.8) is network-reachable with low complexity, but the decisive constraint is PR:H - exploitation requires existing administrator-level WordPress access, which dramatically narrows the realistic threat population to already-privileged (or account-compromised) users. The EPSS score of 0.39% (31st percentile) is consistent with this low practical urgency and indicates no observed exploitation pressure. The vulnerability is not listed in CISA KEV and no public exploit code was identified in the provided references, so there is no evidence of active exploitation. The signals are internally consistent: a credible SSRF with real confidentiality impact (S:C/C:H) to internal services, gated behind administrator authentication, with low exploitation probability. One minor tension worth noting: the description states attackers can 'query and modify information from internal services,' implying some integrity impact, yet the supplied CVSS vector sets I:N - this is a modeling choice (impact scored only on confidentiality of the exfiltrated response) rather than a contradiction, but defenders operating sensitive internal services should treat potential write-side SSRF effects as plausible.

An authenticated administrator (or an attacker who has compromised an admin account) sends a crafted request to the plugin's '/scanner/scan-without-login' REST endpoint with a malicious 'url' parameter pointing at an internal resource (e.g., a cloud metadata endpoint or an internal admin service). The WordPress server dutifully issues the request from its own network position, returning internal data or triggering internal state changes. No public exploit code was identified at time of analysis, though the vulnerable source lines are publicly visible in the WordPress plugin trac.