The WPCOM Member plugin for WordPress is affected by a critical Local File Inclusion vulnerability that allows authenticated users with Contributor-level access or higher to achieve remote code execution.

The vulnerability exists due to improper control of filenames in include statements within the plugin. Authenticated attackers with Contributor-level access can leverage the action parameter to include and execute arbitrary PHP files on the server.

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for severe impact. Successful exploitation permits attackers to bypass access controls, exfiltrate sensitive site data, or gain full control over the application through remote code execution, which could lead to complete system compromise and significant reputational damage.

Immediate Action: Update the WPCOM Member plugin to version 1.7.15 or the latest available version provided by the vendor.

Proactive Monitoring: Review web server logs for suspicious requests containing unexpected file paths or references to local system files within the action parameter of plugin-related endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests targeting shortcode parameters that contain directory traversal patterns or unauthorized file extension inclusions.

Public Exploit Available: Unknown.

Given the severity of the potential impact, administrators should prioritize updating the WPCOM Member plugin immediately. If an update is not feasible, administrators should restrict plugin access or disable the affected shortcode functionality to prevent unauthorized code execution.