WordPress CVEs

Description

The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated.

Affected WordPress components

• EUCookieLaw Plugin · eucookielaw
  Confirmed match Abandoned
  Up to and including 2.7.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• diego-la-monica EUCookieLaw — Up to and including 2.7.2

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/eucookielaw/trunk/templates/EUCookieCache.php#L26
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3288917/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/d360de79-8490-4e70-b2d9-4f01a1ed3305?source=cve
• nvd.nist.gov Official NVD record