A high-severity local file inclusion vulnerability in the Cozmoslabs Paid Member Subscriptions plugin poses a risk of unauthorized file access and potential system compromise.

This vulnerability, categorized as CWE-98, involves improper control of filenames for include or require statements in PHP programs. Based on the CVSS vector (AV:N/AC:H/PR:N/UI:R), the attack can be initiated by an unauthenticated attacker, though it requires specific conditions or user interaction to successfully trigger the file inclusion.

The ability to perform local file inclusion allows an attacker to read sensitive files on the server or potentially execute arbitrary code depending on the server configuration. This compromise could lead to the exposure of database credentials, configuration files, or user data, resulting in significant reputational damage and operational downtime. Given the CVSS score of 7.5, this flaw is considered a high-risk entry point into the web environment.

Immediate Action: Users should restrict access to the affected plugin functionality and verify if a security update has been released by Cozmoslabs, applying it immediately upon availability.

Proactive Monitoring: Security teams should monitor web server access logs for requests containing path traversal sequences or attempts to include unexpected local PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns or unauthorized attempts to access system files via PHP include parameters.

Public Exploit Available: No confirmed public exploit exists in our curated sources.

This vulnerability represents a significant security oversight that could lead to unauthorized system access. Administrators should prioritize identifying instances of this plugin within their infrastructure and ensure they are updated to a version beyond 2.15.4 as soon as the vendor provides a patch. Constant vigilance and the implementation of robust web-level filtering remain the best defenses until a confirmed fix is applied.