The vulnerability CVE-2025-68870 in reDim GmbH's CookieHint WP plugin arises from improper validation of filenames used in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary code execution or disclosure of sensitive files. The issue affects all versions up to 1.0.0. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the web server hosting the CookieHint WP plugin. This can lead to disclosure of sensitive information, code execution, and potentially full system compromise. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the affected plugin to prevent exploitation.