CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated.
Explanation of Vulnerability in Simple Terms
EUCookieLaw versions up to 2.7.2 contain a path traversal vulnerability that allows an attacker to read arbitrary files from the server. The vulnerability requires specific conditions to exploit but does not require authentication. An attacker can access sensitive files outside the intended directory structure, potentially exposing configuration files, database credentials, or other confidential data.
What an attacker can do
Read arbitrary files from the server, including sensitive configuration and credential files.
Potential impact on your site
Sensitive files on the server may be exposed, including database credentials and configuration data.
Conditions required to exploit
Network access; specific conditions must be met (attack complexity is high).
Key dates
External resources
Related vulnerabilities
