CVE-2025-3897: EUCookieLaw WordPress Info Disclosure Flaw

CVE-2025-3897 Overview

CVE-2025-3897 affects the EUCookieLaw plugin for WordPress in all versions up to and including 2.7.2. The plugin uses the PHP file_get_contents function in a way that allows unauthenticated attackers to read arbitrary files on the underlying server. Successful exploitation exposes sensitive configuration files, credentials, and other server-side data. The vulnerability is only reachable when a caching plugin such as W3 Total Cache is installed and active alongside EUCookieLaw. The issue is tracked as a Path Traversal weakness under [CWE-22].

Critical Impact
Unauthenticated attackers can read arbitrary files on the server, potentially disclosing wp-config.php, credentials, and other sensitive data when a caching plugin is active.

Affected Products

EUCookieLaw plugin for WordPress, versions ≤ 2.7.2
WordPress sites additionally running W3 Total Cache or an equivalent caching plugin
Any hosting environment where the plugin can access sensitive server files via PHP

Discovery Timeline

2025-05-09 - CVE-2025-3897 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3897

Vulnerability Analysis

The EUCookieLaw plugin implements a cache-serving template at templates/EUCookieCache.php that passes attacker-influenced input into the file_get_contents PHP function. Because the plugin does not adequately validate or normalize the requested path, an unauthenticated request can traverse the filesystem and retrieve arbitrary readable files. The output is returned to the requester as page content, disclosing whatever the PHP process can read. Sensitive targets include wp-config.php, private keys, log files, and OS-level configuration such as /etc/passwd. The exploit prerequisite is that a caching plugin like W3 Total Cache be active, since caching hooks are what route requests through the vulnerable template.

Root Cause

The root cause is missing path sanitization on user-controlled input consumed by file_get_contents. The plugin trusts request-derived data to construct a file path without confining reads to a safe base directory or rejecting traversal sequences like ../. This is a classic Path Traversal weakness [CWE-22]. The vulnerable code path is visible in the plugin source at the EUCookieCache template.

Attack Vector

Exploitation is remote and unauthenticated over HTTP or HTTPS. An attacker crafts a request that triggers the cache template on a WordPress site running both EUCookieLaw ≤ 2.7.2 and a compatible caching plugin. The request supplies a manipulated path that resolves outside the intended cache directory. The server returns the target file contents in the HTTP response. No user interaction is required, though attack complexity is elevated by the requirement for a specific plugin combination to be present and active.

No verified proof-of-concept code is publicly available. Technical detail is documented in the Wordfence vulnerability analysis and the fix is committed in WordPress Changeset 3288917.

Detection Methods for CVE-2025-3897

Indicators of Compromise

HTTP requests to EUCookieLaw cache endpoints containing directory traversal sequences such as ../ or URL-encoded equivalents like %2e%2e%2f.
Web server responses that return file contents matching wp-config.php, /etc/passwd, or other sensitive files instead of cached HTML.
Anomalous outbound content sizes from PHP responses tied to the EUCookieLaw plugin path.
Access log entries with unauthenticated requests targeting templates/EUCookieCache.php or plugin cache handlers.

Detection Strategies

Inspect WordPress access logs for GET or POST requests referencing EUCookieLaw with path parameters containing traversal patterns.
Deploy web application firewall rules that block requests containing ../ sequences against WordPress plugin endpoints.
Correlate installation of EUCookieLaw ≤ 2.7.2 with active caching plugins across managed WordPress fleets to identify exposed hosts.

Monitoring Recommendations

Alert on reads of wp-config.php or files outside the WordPress content directory by the PHP-FPM or web server process.
Monitor file integrity and access patterns on WordPress hosts, flagging unexpected reads of credential and configuration files.
Track plugin inventory and version drift so vulnerable EUCookieLaw installations are surfaced promptly after disclosure.

How to Mitigate CVE-2025-3897

Immediate Actions Required

Update the EUCookieLaw plugin to a version later than 2.7.2 that includes the fix from changeset 3288917.
If a patched version is unavailable, deactivate and remove the EUCookieLaw plugin from all WordPress sites.
Rotate any secrets stored in wp-config.php if server logs indicate suspicious cache-template requests, since disclosure cannot be ruled out.
Audit installed caching plugins such as W3 Total Cache and confirm they are not exposing the vulnerable code path.

Patch Information

The fix is applied in WordPress Changeset 3288917, which corrects the unsafe use of file_get_contents in the EUCookieCache template. Site administrators should upgrade EUCookieLaw through the WordPress plugin updater or by replacing the plugin files with the patched release. Verify the installed version reads higher than 2.7.2 after the update.

Workarounds

Temporarily deactivate the caching plugin (for example, W3 Total Cache) to break the exploitation prerequisite until EUCookieLaw is patched.
Add web application firewall rules to block requests to EUCookieLaw endpoints that contain path traversal sequences.
Restrict the PHP process file permissions so it cannot read sensitive files outside the WordPress webroot.

bash

# Example WAF rule to block traversal against EUCookieLaw cache endpoint
SecRule REQUEST_URI "@contains eucookielaw" \
  "chain,deny,status:403,id:1003897,msg:'Block CVE-2025-3897 traversal attempt'"
  SecRule REQUEST_URI|ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"