# FAZ Cookie Manager <= 1.34.0 - Unauthenticated Web Cache Poisoning via Crawler User-Agent

- **ID:** WPSEC-2026-1092
- **Plugin:** FAZ Cookie Manager (`faz-cookie-manager`), https://wordpress.org/plugins/faz-cookie-manager/
- **Affected versions:** from 1.5.0 before 1.34.1
- **Fixed in:** 1.34.1 (Update to 1.34.1 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-349
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/faz-cookie-manager
- **Fix released:** 2026-10-14
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1092/

## Description

The FAZ Cookie Manager plugin for WordPress is vulnerable to Web Cache Poisoning via the 'Hide banner from bots' feature in all versions up to, and including, 1.34.0, due to the plugin serving a page without the consent banner and consent runtime to any request whose User-Agent matches a crawler pattern, without marking that response as uncacheable or varying it by User-Agent. This makes it possible for unauthenticated attackers to request a page with a crawler User-Agent so that a full-page cache stores the banner-less copy and serves it to later visitors, who then get no consent banner or consent withdrawal control, and resources that scripts insert after page load are no longer held back until consent. Exploitation requires a full-page cache that does not key on the User-Agent and Cache Compatibility Mode to be disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1092/
- https://plugins.svn.wordpress.org/faz-cookie-manager/tags/1.34.1/
- https://wordpress.org/plugins/faz-cookie-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1092/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.