A critical Local File Inclusion vulnerability in the SEOPress for MainWP plugin allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

This vulnerability is a Local File Inclusion (LFI) flaw, categorized under CWE-98, where the application fails to properly sanitize user-supplied input used in file inclusion functions. The vulnerability is exploitable by an unauthenticated attacker, potentially leading to unauthorized information disclosure or remote code execution depending on the server configuration.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site. An attacker could gain access to sensitive configuration files, such as wp-config.php, or leverage the LFI to execute arbitrary code, which could result in full site compromise, data breaches, and significant reputational damage. Given the CVSS score of 7.5, this issue represents a high-risk security gap that requires immediate attention.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the SEOPress for MainWP plugin until an official security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences, such as double dots or unexpected file paths, directed toward the plugin endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts, which may provide a temporary layer of protection.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, the risk associated with this vulnerability is significant. We strongly recommend that all users of the SEOPress for MainWP plugin discontinue its use until the vendor provides a verified fix. Monitoring for updates from the official source is essential, and the plugin should only be re-enabled after applying a confirmed secure version.