Lifecycle Timeline
2DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows PHP Local File Inclusion.This issue affects CookieHint WP: from n/a through <= 1.0.0.
AnalysisAI
Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Technical ContextAI
The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP weakness where user-supplied input is directly used in include(), require(), include_once(), or require_once() functions without proper validation or sanitization. The CookieHint WP plugin (CPE data not provided in intelligence, but identified as WordPress plugin from reDim GmbH) fails to restrict file paths before including them, allowing attackers to traverse the filesystem using directory traversal sequences (e.g., ../) or absolute paths to access files outside the intended directory structure. This is distinct from remote file inclusion (RFI) since it is limited to local filesystem access, but equally dangerous for information disclosure attacks.
Affected ProductsAI
reDim GmbH CookieHint WP WordPress plugin versions from an unspecified baseline through version 1.0.0 inclusive. The plugin is distributed via the WordPress plugin repository and affects all installations of this plugin at version 1.0.0 or earlier. Specific CPE string not provided in intelligence, but the plugin is identified as a WordPress plugin and can be referenced as wordpress/cookiehint-wp.
RemediationAI
The primary remediation is to update the CookieHint WP plugin immediately to a patched version released after 1.0.0. Organizations running CookieHint WP must verify plugin updates are available from the WordPress plugin repository or reDim GmbH's official channels and apply them as soon as possible. If patched versions are not immediately available, consider disabling or removing the CookieHint WP plugin until a fix is released. Implement web application firewalls (WAF) rules to detect and block common local file inclusion patterns such as directory traversal sequences (../) and protocol wrappers (php://, file://) in request parameters to the affected plugin until patching is complete. Review access logs for signs of exploitation attempts targeting the plugin's vulnerable functionality. Reference: Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/cookiehint-wp/vulnerability/wordpress-cookiehint-wp-plugin-1-0-0-local-file-inclusion-vulnerability for detailed technical information and patching guidance.
Share
External POC / Exploit Code
Leaving vuln.today