The vulnerability is an improper control of the filename used in an include/require statement in the CookieHint WP plugin. This flaw permits an attacker to read arbitrary local files through the PHP application, potentially exposing sensitive configuration data or credentials and creating a path to further exploitation. It corresponds to CWE-98, the improper control of filename in include/require statements.

The plugin CookieHint WP from reDim GmbH is affected in all releases up to and including version 1.0.0. Any WordPress site running a vulnerable version of this plugin is at risk.

The base CVSS score of 7.5 classifies the issue as high severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a crafted request to the plugin’s include endpoint to trigger the local file inclusion; the exploit is local to the web application and does not require elevated privileges.