The Leyka plugin for WordPress is vulnerable to path traversal, which could allow an unauthenticated attacker to perform local file inclusion and compromise the host environment.

This is a path traversal vulnerability (CWE-35) triggered via improper handling of directory traversal sequences, such as .../...//, allowing an unauthenticated attacker to read arbitrary files or execute local PHP files.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary code on the server, resulting in complete system compromise, data theft, and significant operational downtime.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the vendor advisory for the release of an update and apply it immediately upon availability.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns, such as sequences of dots and slashes, directed toward the plugin files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malicious file inclusion requests.

Public Exploit Available: Unknown.

Given the high impact of local file inclusion vulnerabilities, organizations currently running the Leyka plugin should evaluate the business necessity of the software. If the plugin is not mission-critical, disabling or removing it until a security patch is provided is the most effective way to mitigate this risk. Ensure that security teams are alerted to any vendor updates regarding this specific CVE.