The immonex Kickstart Team plugin contains a critical Local File Inclusion vulnerability that allows authenticated attackers to potentially execute arbitrary code on the underlying server.

This vulnerability, identified as CWE-98, stems from improper sanitization of filenames within PHP include or require statements. An attacker with low-level authenticated access can manipulate these inputs to include arbitrary local files, leading to sensitive data exposure or remote code execution.

The vulnerability carries a CVSS score of 7.5, reflecting a high severity risk. Successful exploitation could allow an attacker to bypass security controls, access sensitive configuration files, or gain full control over the WordPress application environment, leading to significant data breaches and total system compromise.

Immediate Action: There is currently no confirmed patch available from the vendor; users should immediately deactivate and remove the Kickstart Team plugin from their WordPress environments until an update is released.

Proactive Monitoring: Security teams should monitor web server access logs for unusual include patterns or attempts to access system files, such as wp-config.php, via suspicious query parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and file inclusion attempts targeting PHP applications.

Public Exploit Available: Unknown.

Given the potential for complete system compromise, the risk posed by this vulnerability is significant. Administrators must prioritize the removal of the vulnerable plugin from all production instances. Continued monitoring of the vendor's security advisories is essential to identify when a secure version is available for deployment.