CVE-2025-12136 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin up to version 5.2.4. The issue is due to insufficient validation of the 'url' parameter in the '/scanner/scan-without-login' REST API endpoint. Authenticated attackers with administrator privileges can leverage this flaw to make arbitrary HTTP requests from the server, potentially interacting with internal services. The vulnerability is classified under CWE-918 and has a CVSS 3.1 base score of 6.8 (medium severity). There is no indication of known exploits in the wild or available patches at this time.

An attacker with administrator-level access can exploit this SSRF vulnerability to make arbitrary HTTP requests from the affected server. This could allow the attacker to query or modify internal services that are otherwise inaccessible externally. The vulnerability does not directly impact confidentiality or availability but can lead to unauthorized information disclosure or internal service manipulation. The CVSS score of 6.8 reflects a medium severity impact primarily on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator-level access to trusted users only and monitor for suspicious activity related to the '/scanner/scan-without-login' endpoint. Avoid exposing this endpoint unnecessarily. Follow vendor communications for updates on patches or official mitigations.