CVE-2025-3897: Diego-La-Monica Eucookielaw

Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days.

The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability can only be exploited if a caching plugin such as W3 Total Cache is installed and activated.

Affected products

• Diego-La-Monica Eucookielaw: up to and including 2.7.2

Published 2025-05-09. Last modified 2026-06-17.