The Acato WP REST Cache plugin contains a critical local file inclusion vulnerability that permits unauthenticated attackers to execute arbitrary code on affected WordPress installations.

This vulnerability is a PHP Local File Inclusion flaw (CWE-98) stemming from improper control of filenames used in include or require statements. The vulnerability is accessible to unauthenticated attackers via the plugin, as indicated by the CVSS vector AV:N/PR:N.

The ability to perform local file inclusion poses a severe risk to business operations, as it allows unauthorized actors to read sensitive configuration files or execute arbitrary code on the server. Given the CVSS score of 7.5, this high-severity flaw could lead to complete system compromise, unauthorized data exfiltration, and significant reputational damage if the underlying WordPress environment is breached.

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate and remove the WP REST Cache plugin from their environments until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting the WP REST Cache plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unauthorized file inclusion requests to provide a temporary layer of protection.

Public Exploit Available: No (exploit_available: false).

Due to the critical nature of file inclusion vulnerabilities, the risk of total system compromise is high. Security teams must prioritize the immediate removal of the vulnerable plugin to eliminate the attack surface. Monitor for vendor updates through official WordPress repository channels and only re-enable the functionality once a verified, secure version is available for deployment.