A high-severity Local File Inclusion vulnerability in the Processby Lazy Load Optimizer plugin for WordPress could allow an attacker to access sensitive local files.

The plugin fails to properly sanitize filenames used in PHP include or require functions, which results in a Local File Inclusion vulnerability. The CVSS vector indicates that this flaw can be triggered by an unauthenticated attacker, though it requires specific user interaction.

The ability to perform Local File Inclusion (LFI) poses a significant risk to organizational data, as it allows attackers to read arbitrary files from the web server. This may lead to the exposure of sensitive configuration files, database credentials, or application source code. With a CVSS score of 7.5, this vulnerability is classified as High and requires immediate attention to prevent potential system compromise.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the Lazy Load Optimizer plugin from their WordPress environments until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal attempts and unauthorized file inclusion requests targeting PHP scripts.

Public Exploit Available: Unknown.

Given the high severity of this file inclusion vulnerability, organizations should prioritize the removal of the vulnerable plugin to eliminate the attack surface. Administrators must monitor vendor channels for the release of a patched version and perform a thorough security audit of the affected server environment if the plugin was previously active.