The GravityWP Merge Tags plugin for WordPress is vulnerable to local file inclusion, which may allow an unauthenticated attacker to execute arbitrary PHP code or access sensitive files.

This is a local file inclusion (LFI) vulnerability stemming from improper control of filenames used in PHP include or require statements. The vulnerability is accessible to unauthenticated attackers as per the network attack vector and high-level privilege requirements in the CVSS vector.

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive configuration files, internal data, or remote code execution on the underlying server. Given the CVSS score of 7.5, this is considered a high-severity risk that could compromise the integrity and confidentiality of the entire WordPress environment.

Immediate Action: Check the official WordPress plugin repository for a security update that addresses this LFI flaw and update the plugin to the latest available version. If no update is currently available, consider disabling or removing the plugin until a patch is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unusual PHP file inclusions. Monitor for unexpected file modifications or unauthorized outbound network connections from the web server.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common directory traversal sequences and malicious file inclusion attempts. Ensure the PHP environment is configured with open_basedir restrictions to limit the scope of file access.

Public Exploit Available: Unknown.

This vulnerability presents a substantial risk to any site utilizing the affected plugin. Administrators should prioritize identifying instances of this plugin within their infrastructure and apply the necessary updates or mitigation steps immediately to prevent unauthorized system access.