A critical local file inclusion vulnerability in Aman Funnel Builder by FunnelKit allows unauthenticated attackers to execute arbitrary local files, posing a significant risk to server integrity.

The vulnerability, categorized as CWE-98, stems from improper control of filenames used in PHP include or require statements. This flaw allows an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized data disclosure or remote code execution.

The exploitation of this vulnerability can lead to full system compromise, as it allows unauthorized access to sensitive configuration files or the execution of malicious scripts. With a CVSS score of 7.5, this high-severity flaw threatens the confidentiality, integrity, and availability of the hosting environment and any associated customer data.

Immediate Action: Administrators should monitor the vendor's security portal for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Security teams should review web server access logs for unusual patterns, such as directory traversal attempts or requests for sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and restricted directory access requests.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this vulnerability, immediate action is required to secure affected installations. Because a patch is not yet confirmed, administrators should prioritize implementing WAF rules to mitigate the risk of exploitation while awaiting an official vendor update.