FAZ Cookie Manager <= 1.34.0 - Unauthenticated Web Cache Poisoning via Crawler User-Agent
- ID
- WPSEC-2026-1092
- Plugin
- FAZ Cookie Manager (faz-cookie-manager)
- Affected
- from 1.5.0 before 1.34.1
- Remediation
- Update to 1.34.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-349
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- FAZ Cookie Manager on WPSec AttackSurface
- Fix released
- Published
Description
The FAZ Cookie Manager plugin for WordPress is vulnerable to Web Cache Poisoning via the 'Hide banner from bots' feature in all versions up to, and including, 1.34.0, due to the plugin serving a page without the consent banner and consent runtime to any request whose User-Agent matches a crawler pattern, without marking that response as uncacheable or varying it by User-Agent. This makes it possible for unauthenticated attackers to request a page with a crawler User-Agent so that a full-page cache stores the banner-less copy and serves it to later visitors, who then get no consent banner or consent withdrawal control, and resources that scripts insert after page load are no longer held back until consent. Exploitation requires a full-page cache that does not key on the User-Agent and Cache Compatibility Mode to be disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1092/
- https://plugins.svn.wordpress.org/faz-cookie-manager/tags/1.34.1/
- https://wordpress.org/plugins/faz-cookie-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS