{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ajonkastonkacookies_and_content_security_policywordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jonkastonka:cookies_and_content_security_policy:*:*:*:*:*:wordpress:*:*","cpe:2.3:a:followmedarling:cookies_and_content_security_policy:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2025-51529"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cookies and Content Security Policy (\u003c= 2.29)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Johan Jonk Stenstroem"],"content_html":"\u003cp\u003eThe Cookies and Content Security Policy WordPress plugin through version 2.29 contains an incorrect access control vulnerability (CVE-2025-51529) in its AJAX endpoint \u003ccode\u003ecacsp_insert_consent_data\u003c/code\u003e. The endpoint is exposed via \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e without authentication or rate limiting. An unauthenticated attacker can send continuous POST requests to this endpoint, triggering unauthorized database writes that lead to CPU and disk I/O exhaustion, effectively causing a denial of service for the WordPress site. A public proof-of-concept exists for this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress instance running Cookies and Content Security Policy plugin \u0026lt;= 2.29.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the publicly accessible \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker initiates continuous POST requests specifying the \u003ccode\u003ecacsp_insert_consent_data\u003c/code\u003e action.\u003c/li\u003e\n\u003cli\u003ePlugin code executes the \u003ccode\u003ecacsp_insert_consent_data()\u003c/code\u003e function without checking for authentication or rate limits.\u003c/li\u003e\n\u003cli\u003eEach request triggers an unvalidated write operation to the WordPress database.\u003c/li\u003e\n\u003cli\u003eRapid successive writes cause database growth, CPU spikes, and I/O exhaustion.\u003c/li\u003e\n\u003cli\u003eTarget server becomes unresponsive due to database resource depletion.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in service unavailability (Denial of Service) for the affected WordPress site due to database resource exhaustion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit WordPress sites for the Cookies and Content Security Policy plugin and ensure they are updated to a version beyond 2.29 if available.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on the \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint at the web server (e.g., Nginx, Apache) or Web Application Firewall (WAF) level.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for high-frequency POST requests to \u003ccode\u003eadmin-ajax.php\u003c/code\u003e containing the \u003ccode\u003ecacsp_insert_consent_data\u003c/code\u003e action.\u003c/li\u003e\n\u003cli\u003eTemporarily disable the plugin if patching is not immediately feasible and the risk of DoS is high.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T06:08:48Z","date_published":"2026-10-24T06:08:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-51529/","summary":"An unauthenticated denial of service vulnerability in the Cookies and Content Security Policy WordPress plugin allows remote attackers to exhaust database resources via unlimited write requests to an unprotected AJAX endpoint.","title":"Cookies and Content Security Policy: Denial of Service via AJAX Endpoint (CVE-2025-51529)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-51529/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:jonkastonka:cookies_and_content_security_policy:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}