CVE-2025-51529
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Cookies and Content Security Policy plugin up to version 2.29 has an access control flaw in an AJAX endpoint. Unauthenticated remote attackers can cause a denial of service by performing unlimited database write operations via the wp_ajax_nopriv_cacsp_insert_consent_data endpoint.
Risk Assessment
The risk is database server resource exhaustion, potentially making the website unavailable to users. The attack requires no authentication, making it easy to exploit.
Recommendation
Immediately update the Cookies and Content Security Policy plugin to the latest version that fixes this vulnerability. If no update is available, temporarily disable the AJAX endpoint or implement request rate limiting.
Original NVD description (English source)
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service (database server resource exhaustion) via unlimited database write operations to the wp_ajax_nopriv_cacsp_insert_consent_data endpoint.