CVE-2025-63019
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | cookies_and_content_security_policy | to 2.34 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the WordPress Cookies and Content Security Policy Plugin (up to version 2.34) allows unauthenticated attackers to retrieve embedded sensitive information that should normally be restricted. It is classified as a Sensitive Data Exposure issue, meaning sensitive data can be accessed improperly without special privileges. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive information, which may enable attackers to exploit other system weaknesses. Although the severity is considered low (CVSS score 5.3), it still poses a risk of data exposure and potential further exploitation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the version of the Cookies and Content Security Policy WordPress plugin installed on your system. If the version is 2.34 or earlier, it is vulnerable. You can use WordPress CLI commands such as `wp plugin list` to check the plugin version. Additionally, monitoring for unusual access to sensitive data or unauthorized data exposure in logs may help detect exploitation attempts. There are no specific commands provided for direct detection of this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Cookies and Content Security Policy plugin to version 2.35 or later, as this version addresses the vulnerability. Additionally, enabling auto-updates for plugins can help ensure timely patching. Since no special privileges are required to exploit this vulnerability, prompt updating is critical to reduce risk. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.