The Tribulant Newsletters plugin is vulnerable to Local File Inclusion, which may allow an unauthenticated attacker to read sensitive files or execute arbitrary code on the host server.

This vulnerability is a Local File Inclusion flaw caused by improper control of filenames in include or require statements. An unauthenticated attacker can trigger this issue to access or execute arbitrary files on the underlying server.

The exploitation of this vulnerability could lead to a full compromise of the affected web application. Because the flaw allows for the inclusion of arbitrary files, an attacker could potentially gain access to sensitive configuration files, database credentials, or achieve remote code execution, resulting in severe data loss and loss of system integrity. The CVSS score of 7.5 reflects the high potential for impact despite the requirement for specific conditions to trigger the attack.

Immediate Action: Administrators should immediately audit their WordPress environment and deactivate the Newsletters plugin until a security patch is released by Tribulant Software.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts, which may mitigate the risk until the plugin is updated.

Public Exploit Available: No

Given the potential for complete system compromise, this vulnerability poses a significant risk to the integrity of the WordPress installation. Organizations currently utilizing the Tribulant Newsletters plugin must prioritize the removal or deactivation of the software until the vendor provides a verified fix. Continuous monitoring of server logs is essential to detect any unauthorized attempts to probe for this vulnerability.