The vulnerability in the Cookie Monster plugin arises from improper handling of filenames passed to PHP include/require statements, identified as CWE‑98. This flaw permits a Local File Inclusion (LFI) attack, enabling an attacker to read arbitrary files from the server’s filesystem or, in certain configurations, inject and execute malicious PHP code, compromising confidentiality, integrity, and potentially availability of the affected WordPress site.

Oscar Alvarez’s Cookie Monster WordPress plugin versions up to and including 1.2.2 are affected. The vulnerability is present in all releases from the earliest version through 1.2.2; any WordPress installation using the plugin in this range without mitigation is at risk.

The CVSS score of 8.1 indicates a high severity issue. An EPSS score of 1% suggests that, while exploitation probability is low, it is not negligible. The vulnerability is not yet listed in the CISA KEV catalog. Inferred attack paths rely on the web server’s ability to pass arbitrary filename parameters to the plugin, which, if an attacker can supply a crafted value via a URL or form input, may trigger local file access. The plugin’s lack of input validation amplifies the risk, especially on systems with loose file permissions.