A high-severity Local File Inclusion vulnerability exists in the Roxnor FundEngine plugin that allows authenticated attackers to potentially execute arbitrary code or access sensitive files.

This is a PHP Local File Inclusion (CWE-98) flaw occurring within the plugin. An attacker with authenticated access can leverage improper validation of filename parameters to manipulate include or require statements, leading to unauthorized file access or remote code execution.

Successful exploitation allows an attacker to read sensitive configuration files or execute arbitrary PHP code on the underlying server. Given the CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and confidentiality of the WordPress environment, potentially leading to full site compromise.

Immediate Action: As no specific patch version is currently identified, administrators should immediately deactivate and remove the wp-fundraising-donation plugin until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for suspicious inclusion patterns, such as requests containing path traversal sequences or references to sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI payloads and path traversal attempts targeting PHP include parameters.

Public Exploit Available: No (exploit_available: false)

The presence of a Local File Inclusion flaw in a WordPress plugin poses a severe risk to server security. We recommend prioritizing the immediate deactivation of the affected component to prevent exploitation, pending an official security patch from the vendor.