Johan Jonk Stenstroem - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/johan-jonk-stenstroem/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 06:08:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCookies and Content Security Policy: Denial of Service via AJAX Endpoint (CVE-2025-51529)https://feed.craftedsignal.io/briefs/2026-10-cve-2025-51529/Sat, 24 Oct 2026 06:08:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2025-51529/An unauthenticated denial of service vulnerability in the Cookies and Content Security Policy WordPress plugin allows remote attackers to exhaust database resources via unlimited write requests to an unprotected AJAX endpoint.The Cookies and Content Security Policy WordPress plugin through version 2.29 contains an incorrect access control vulnerability (CVE-2025-51529) in its AJAX endpoint cacsp_insert_consent_data. The endpoint is exposed via wp-admin/admin-ajax.php without authentication or rate limiting. An unauthenticated attacker can send continuous POST requests to this endpoint, triggering unauthorized database writes that lead to CPU and disk I/O exhaustion, effectively causing a denial of service for the WordPress site. A public proof-of-concept exists for this vulnerability.

Attack Chain

  1. Attacker identifies a WordPress instance running Cookies and Content Security Policy plugin <= 2.29.
  2. Attacker interacts with the publicly accessible wp-admin/admin-ajax.php endpoint.
  3. Attacker initiates continuous POST requests specifying the cacsp_insert_consent_data action.
  4. Plugin code executes the cacsp_insert_consent_data() function without checking for authentication or rate limits.
  5. Each request triggers an unvalidated write operation to the WordPress database.
  6. Rapid successive writes cause database growth, CPU spikes, and I/O exhaustion.
  7. Target server becomes unresponsive due to database resource depletion.

Impact

Successful exploitation results in service unavailability (Denial of Service) for the affected WordPress site due to database resource exhaustion.

Recommendation

  • Immediately audit WordPress sites for the Cookies and Content Security Policy plugin and ensure they are updated to a version beyond 2.29 if available.
  • Implement rate limiting on the /wp-admin/admin-ajax.php endpoint at the web server (e.g., Nginx, Apache) or Web Application Firewall (WAF) level.
  • Monitor web server access logs for high-frequency POST requests to admin-ajax.php containing the cacsp_insert_consent_data action.
  • Temporarily disable the plugin if patching is not immediately feasible and the risk of DoS is high.
]]>mediumadvisory