Skip to content
Threat Feed
Subscribe
medium advisory

Cookies and Content Security Policy: Denial of Service via AJAX Endpoint (CVE-2025-51529)

An unauthenticated denial of service vulnerability in the Cookies and Content Security Policy WordPress plugin allows remote attackers to exhaust database resources via unlimited write requests to an unprotected AJAX endpoint.

CVE search metadata

CVE search record: CVE-2025-51529. Severity: medium. CVSS: 5.3. EPSS: 0.44%. KEV: no. Product: Cookies and Content Security Policy (<= 2.29). Brief: Cookies and Content Security Policy: Denial of Service via AJAX Endpoint (CVE-2025-51529). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2025-51529/

Triage facts

Revision 1
Applicability
Cookies and Content Security Policy (<= 2.29)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 24, 06:08 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Likely

The Cookies and Content Security Policy WordPress plugin through version 2.29 contains an incorrect access control vulnerability (CVE-2025-51529) in its AJAX endpoint cacsp_insert_consent_data. The endpoint is exposed via wp-admin/admin-ajax.php without authentication or rate limiting. An unauthenticated attacker can send continuous POST requests to this endpoint, triggering unauthorized database writes that lead to CPU and disk I/O exhaustion, effectively causing a denial of service for the WordPress site. A public proof-of-concept exists for this vulnerability.

Attack Chain

  1. Attacker identifies a WordPress instance running Cookies and Content Security Policy plugin <= 2.29.
  2. Attacker interacts with the publicly accessible wp-admin/admin-ajax.php endpoint.
  3. Attacker initiates continuous POST requests specifying the cacsp_insert_consent_data action.
  4. Plugin code executes the cacsp_insert_consent_data() function without checking for authentication or rate limits.
  5. Each request triggers an unvalidated write operation to the WordPress database.
  6. Rapid successive writes cause database growth, CPU spikes, and I/O exhaustion.
  7. Target server becomes unresponsive due to database resource depletion.

Impact

Successful exploitation results in service unavailability (Denial of Service) for the affected WordPress site due to database resource exhaustion.

Recommendation

  • Immediately audit WordPress sites for the Cookies and Content Security Policy plugin and ensure they are updated to a version beyond 2.29 if available.
  • Implement rate limiting on the /wp-admin/admin-ajax.php endpoint at the web server (e.g., Nginx, Apache) or Web Application Firewall (WAF) level.
  • Monitor web server access logs for high-frequency POST requests to admin-ajax.php containing the cacsp_insert_consent_data action.
  • Temporarily disable the plugin if patching is not immediately feasible and the risk of DoS is high.

Immediate actions

Inventory all WordPress instances running the Cookies and Content Security Policy plugin and check version numbers.

IT Operations 24h

Deploy Sigma rule to detect high-frequency POST requests to the vulnerable AJAX endpoint.

Detection Engineering 48h

Threat Hunt

Identify anomalies in webserver access logs where the volume of POST requests to /wp-admin/admin-ajax.php has increased significantly from specific IPs.

T1499.004 high high confidence hunt now

Data: webserver access logs

Enrichment needed

  • Plugin vendor update status (CTI) Confirm if a patch exists beyond 2.29.

Mitigations

Implement WAF rate limiting for the affected endpoint.

immediate IT Operations

CVE-2025-51529

Detection coverage 1

Detect Potential CVE-2025-51529 Exploitation

medium

Detects repeated POST requests to the vulnerable admin-ajax.php endpoint which may indicate a DoS attempt targeting the cacsp_insert_consent_data function

sigma tactics: impact techniques: T1499.004 sources: webserver

Detection queries are available on the platform. Get full rules →