The EUCookieLaw plugin for WordPress contains a flaw that allows an attacker to read the contents of any file on the server. The vulnerability arises from an unvalidated use of the 'file_get_contents' function and is classified as CWE‑22. If exploited, a malicious user can obtain sensitive files such as configuration data, passwords, or other confidential information, compromising the confidentiality of the site.

The issue affects WordPress sites that have installed the EUCookieLaw plugin versions 2.7.2 or earlier. The plugin must be used in conjunction with a caching solution – for example, W3 Total Cache – that is enabled during the attack window. Sites running an older version of the plugin combined with an active caching plugin are therefore at risk.

The CVSS score of 5.9 indicates a medium severity vulnerability. The EPSS score is less than 1% and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely at present. Nevertheless, the attack vector requires an unauthenticated user to trigger the plugin’s file read logic while a caching plugin is active, making the vulnerability easier to exploit on sites that have both components installed.