CVE-2025-53197

Vulnerability

Overview

Cross-Site Request Forgery (CSRF) vulnerability exists in the Cookiebot WordPress plugin versions from n/a through 4.5.8. The plugin fails to properly validate or verify requests, allowing an attacker to craft malicious requests that execute unintended actions on behalf of an authenticated administrator [1].

Exploitation

Conditions

Exploitation requires user interaction - a privileged user must click a malicious link, visit a crafted page, or submit a form while authenticated. This CSRF flaw can be triggered without requiring any additional privileges beyond the victim's existing session [1].

Impact

Successful exploitation enables an attacker to perform unwanted actions under the victim's authentication, such as changing plugin settings, modifying cookie consent configurations, or performing other administrative operations. The CVSS v3 score is 4.3 (Medium), reflecting the need for user interaction [1].

Mitigation

The vulnerability is patched in version 4.5.9. Users are strongly advised to update immediately. For those unable to update, auto-update features can be enabled via Patchstack or manually applying the latest version [1].