A Local File Inclusion vulnerability in the LCweb PrivateContent - Mail Actions plugin allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

The plugin fails to properly sanitize filenames used in include or require statements, resulting in a Local File Inclusion (LFI) flaw. This vulnerability can be triggered by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

The ability to perform Local File Inclusion poses a severe risk to business operations, as it may allow an attacker to read sensitive configuration files, credentials, or source code from the server. Given the CVSS score of 7.5, this high-severity flaw could lead to full system compromise, resulting in significant data breaches and long-term reputational damage.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the PrivateContent - Mail Actions plugin until a vendor-supplied security update is released.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing path traversal sequences or unexpected file extension inclusions directed at the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common LFI patterns and directory traversal attempts to provide temporary protection.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to the integrity of the WordPress environment. Administrators should treat this as a high-priority issue and ensure the affected plugin is disabled immediately to prevent potential exploitation while awaiting a permanent fix from the vendor.