A critical Local File Inclusion vulnerability in the cmsmasters Content Composer plugin allows unauthenticated attackers to potentially achieve full system compromise.

The plugin fails to properly validate filenames used in PHP include or require statements, which allows an unauthenticated attacker to perform Local File Inclusion. This flaw enables attackers to read sensitive files or potentially execute arbitrary code on the server.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive server-side files, such as configuration files containing database credentials or application secrets. Given the CVSS score of 8.1, this vulnerability represents a high risk to the confidentiality and integrity of the application, potentially leading to a complete compromise of the hosting environment.

Immediate Action: Review the official Patchstack advisory for the latest update and update the cmsmasters Content Composer plugin to the version specified as fixed. If no update is currently available, disable the plugin immediately to prevent exploitation.

Proactive Monitoring: Monitor server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like /etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common directory traversal sequences and malicious file inclusion attempts.

Public Exploit Available: Unknown

This vulnerability presents a significant security risk due to the potential for unauthorized file access and remote code execution. Security teams should prioritize updating the affected plugin immediately upon the release of a security patch. Until a fix is applied, strict access controls and WAF filtering are necessary to mitigate the risk of exploitation.