CVE-2025-51529

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-51529
Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service (database server resource exhaustion) via unlimited database write operations to the wp_ajax_nopriv_cacsp_insert_consent_data endpoint.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://cookies.com Not Applicable
http://johan.com Not Applicable
https://gist.github.com/piotrmaciejbednarski/f738145c0ab24a110649dc16907e395b Product
https://github.com/piotrmaciejbednarski/CVE-2025-51529 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:followmedarling:cookies_and_content_security_policy:*:*:*:*:*:wordpress:*:*
History

21 Oct 2025, 14:25

Type Values Removed Values Added
References () http://cookies.com - () http://cookies.com - Not Applicable
References () http://johan.com - () http://johan.com - Not Applicable
References () https://gist.github.com/piotrmaciejbednarski/f738145c0ab24a110649dc16907e395b - () https://gist.github.com/piotrmaciejbednarski/f738145c0ab24a110649dc16907e395b - Product
References () https://github.com/piotrmaciejbednarski/CVE-2025-51529 - () https://github.com/piotrmaciejbednarski/CVE-2025-51529 - Exploit, Third Party Advisory
First Time Followmedarling
Followmedarling cookies And Content Security Policy
CPE cpe:2.3:a:followmedarling:cookies_and_content_security_policy:*:*:*:*:*:wordpress:*:*

20 Aug 2025, 14:40

Type Values Removed Values Added
Summary
  • (es) El control de acceso incorrecto en la funcionalidad del endpoint AJAX en el complemento de política de seguridad de contenido y cookies de jonkastonka hasta la versión 2.29 permite a atacantes remotos provocar una denegación de servicio (agotamiento de los recursos del servidor de base de datos) a través de operaciones de escritura de base de datos ilimitadas en el endpoint wp_ajax_nopriv_cacsp_insert_consent_data.

19 Aug 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-284

19 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-19 15:15

Updated : 2025-10-21 14:25

NVD link : CVE-2025-51529

Mitre link : CVE-2025-51529

CVE.ORG link : CVE-2025-51529

JSON object : View

Products Affected

followmedarling

  • cookies_and_content_security_policy
CWE
CWE-284

Improper Access Control