A high-severity Local File Inclusion vulnerability in the eyecix JobSearch plugin allows authenticated attackers to potentially execute arbitrary files on the underlying server.

The plugin fails to properly sanitize user-supplied input used in PHP include or require statements, enabling a Local File Inclusion (LFI) flaw. This vulnerability requires the attacker to have at least low-level authenticated access to the system.

The vulnerability carries a CVSS score of 7.5, reflecting its potential to lead to total system compromise. Successful exploitation allows an attacker to include local files, which may result in sensitive data exposure, unauthorized configuration changes, or remote code execution, posing a significant risk to the integrity and confidentiality of the WordPress environment.

Immediate Action: Since a specific patch version is not currently listed, administrators should monitor the vendor website for the release of version 3.0.8 or higher and apply it immediately. If no update is available, consider disabling or uninstalling the plugin until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file path inclusions directed at the wp-jobsearch plugin components.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences (such as ../) targeted at the plugin's vulnerable endpoints.

Public Exploit Available: Unknown.

Given the potential for total system compromise, this vulnerability should be treated with high urgency. Administrators must restrict access to the affected plugin functionality and remain vigilant for vendor security bulletins. Applying the forthcoming update is the only definitive method to eliminate this risk.