The Pluginwale Easy Pricing Table WP plugin contains a local file inclusion vulnerability that could allow an authenticated attacker to compromise the host server.

This vulnerability is classified as CWE-98, involving improper control of filenames for include or require statements in PHP. It requires the attacker to have at least low-level authenticated access to the application to trigger the file inclusion.

Successful exploitation of this vulnerability can lead to sensitive information disclosure, unauthorized code execution, or full system compromise, depending on the files accessible on the server. Given the CVSS score of 7.5, this is classified as a high-severity risk that could lead to significant data breaches or operational downtime for the affected WordPress instance.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or uninstall the Easy Pricing Table WP plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file paths in query parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block local file inclusion attempts and restrict unauthorized file access patterns.

Public Exploit Available: Unknown.

Given the high CVSS severity, this vulnerability presents a substantial risk to the integrity and confidentiality of the host environment. Organizations should prioritize the removal of the vulnerable plugin and monitor for any signs of unauthorized file access until the vendor provides a verified security update.