The PublishPress Gutenberg Blocks plugin is vulnerable to local file inclusion, which could allow an attacker to execute arbitrary local files on the host server.

The plugin suffers from improper control of filenames used in PHP include or require statements, categorized as CWE-98. Based on the CVSS vector, this vulnerability is reachable by an unauthenticated attacker, though it requires user interaction and specific conditions to exploit successfully.

This vulnerability poses a significant risk to the integrity and confidentiality of the host environment. By leveraging local file inclusion, an attacker may be able to read sensitive configuration files or execute unauthorized code, leading to a full compromise of the application. With a CVSS score of 7.5, this is classified as a High severity issue that requires immediate attention to prevent unauthorized system access.

Immediate Action: Administrators should check the official PublishPress plugin repository or vendor advisory for the release of a patched version and update the plugin immediately. If a patch is not available, consider disabling the plugin until a secure version is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unusual file path inclusions. Monitor system performance for unexpected spikes in resource utilization that may indicate malicious code execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and malicious input targeting PHP include functions.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized code execution and file access, this vulnerability must be treated as a high priority. Organizations using the PublishPress Gutenberg Blocks plugin should prioritize monitoring for vendor updates and apply the fix as soon as it becomes available to ensure the continued security of their web infrastructure.