Executive brief
A vulnerability in the Cookies and Content Security Policy plugin for WordPress allows unauthorized users to flood a website's database with junk data. This plugin is used to manage user cookie consent and security headers. An attacker can exploit this to exhaust server resources, potentially causing the website to become slow or completely unavailable to legitimate visitors.
Technical details
The vulnerability exists in the 'cacsp_insert_consent_data' function, which is exposed via the WordPress AJAX endpoint (admin-ajax.php) using the 'wp_ajax_nopriv_' hook. This allows unauthenticated remote attackers to trigger database write operations without any rate limiting or nonce verification. By sending a high volume of concurrent POST requests to this endpoint, an attacker can cause database server resource exhaustion (CPU, disk I/O, and storage growth), leading to a denial of service. The exploit involves sending crafted payloads to the 'cacsp_insert_consent_data' action, which inserts rows into the database for every request received.
Affected products
- jonkastonka (Johan Jonk Stenstroem) Cookies and Content Security Policy through 2.29
Timeline
- 2025-05-11: other: Proof of concept payload created
- 2025-08-19: advisory: NVD publication date