PHP Remote File Inclusion in Oscar Alvarez Cookie Monster Plugin
CVE-2025-22656

8.1HIGH

Key Information:

Vendor

WordPress
Status
Cookie Monster
Vendor
CVE Published:
18 February 2025

What is CVE-2025-22656?

The Oscar Alvarez Cookie Monster plugin is susceptible to a PHP Remote File Inclusion vulnerability, allowing an attacker to execute local files. This security flaw arises from improper control over filenames in include/require statements within the plugin. Attackers exploiting this vulnerability could potentially gain unauthorized access to sensitive files on the web server running vulnerable versions of the plugin. Users are encouraged to update to the latest version to mitigate risks.

Affected Version(s)

Cookie Monster <= 1.2.2

References

https://patchstack.com/database/wordpress/plugin/cookie-m...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.