The vulnerability identified as CVE-2025-68886 in androThemes Cookiteer is classified under CWE-98, indicating improper control of filenames in PHP include or require statements. This weakness allows an attacker to perform Local File Inclusion (LFI), potentially enabling unauthorized access to sensitive files or code execution within the affected PHP application. The issue affects Cookiteer versions up to 1.4.8. The CVSS v3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. There is no vendor-provided patch or official remediation at this time, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system running Cookiteer. An attacker could include local files, potentially exposing sensitive data or executing arbitrary code within the PHP environment. This could result in unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application, applying web application firewall rules to detect and block suspicious include/require requests, and reviewing application configurations to limit file inclusion paths. Avoid exposing the application to untrusted inputs that control file inclusion parameters.