The Real Cookie Banner plugin’s /scanner/scan-without-login endpoint fails to validate the user‑supplied URL parameter. This flaw enables an authenticated administrator or higher‑privileged user to cause the server to fetch any address it can reach, allowing the attacker to scan, read or modify internal network resources. The resulting data disclosure or alteration compromises confidentiality, integrity and, in some scenarios, availability of services behind the WordPress host.

The vulnerability is present in all releases of the devowl Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress up to and including version 5.2.4.

With a CVSS score of 6.8 the issue is considered medium severity, and the EPSS score of less than 1 % indicates a low probability of exploitation at present. The flaw requires administrative authentication, but once accessed it gives the attacker the ability to issue arbitrary HTTP requests from the host, potentially exposing internal resources. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation has been reported yet.