A critical local file inclusion vulnerability in the Anchor smooth scroll plugin allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

This vulnerability, categorized as CWE-98, occurs when the plugin improperly handles file inputs for PHP include statements, allowing an unauthenticated attacker to perform Local File Inclusion.

Successful exploitation of this vulnerability poses a severe risk to organizational data and system integrity. Because the flaw allows for Local File Inclusion, an attacker could read sensitive configuration files, such as wp-config.php, or potentially achieve remote code execution depending on the server environment. Given the high CVSS score of 8.2, this vulnerability should be treated as a high-priority security event that could lead to full system compromise.

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate and uninstall the Anchor smooth scroll plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and prevent unauthorized access to sensitive PHP files.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate action to remove the vulnerable component from the production environment. Organizations relying on the Anchor smooth scroll plugin must prioritize deactivation to eliminate the attack surface, as Local File Inclusion flaws are frequently leveraged for initial access and lateral movement within web hosting environments.