PHP Remote File Inclusion in Oscar Alvarez Cookie Monster Plugin

CVE-2025-22656

Summary

The Oscar Alvarez Cookie Monster plugin is susceptible to a PHP Remote File Inclusion vulnerability, allowing an attacker to execute local files. This security flaw arises from improper control over filenames in include/require statements within the plugin. Attackers exploiting this vulnerability could potentially gain unauthorized access to sensitive files on the web server running vulnerable versions of the plugin. Users are encouraged to update to the latest version to mitigate risks.

References