A local file inclusion vulnerability in the Premmerce User Roles plugin could allow an unauthenticated attacker to read sensitive files or potentially achieve code execution.

The plugin suffers from an improper control of filenames for include or require statements, which enables local file inclusion. Based on the CVSS vector, the flaw can be triggered by an unauthenticated attacker over the network, though it requires user interaction.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive server-side files, such as configuration or credential files. Given the high severity CVSS score of 7.5, there is a significant risk of full system compromise, which could result in severe data breaches and total loss of confidentiality, integrity, and availability for the affected WordPress environment.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate or uninstall the Premmerce User Roles plugin until an official security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or unexpected file path inclusions targeting the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion signatures and directory traversal attempts to mitigate potential exploitation.

Public Exploit Available: No.

The presence of a local file inclusion vulnerability presents an unacceptable risk to the security of the hosting environment. Organizations utilizing the Premmerce User Roles plugin must prioritize the immediate removal of the vulnerable software until the vendor provides a verified fix, as remediation via configuration alone may be insufficient to prevent exploitation.