A high-severity local file inclusion vulnerability in the Clearblue Ovulation Calculator plugin allows unauthenticated attackers to potentially read sensitive local files.

The plugin suffers from a local file inclusion flaw (CWE-98) where user-supplied input is not properly sanitized before being used in PHP file inclusion functions. This vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector AV:N/PR:N.

The ability to perform local file inclusion poses a significant risk to the confidentiality and integrity of the hosting environment. By traversing the file system, an attacker could potentially read sensitive configuration files, including database credentials or system files, leading to full site compromise. With a CVSS score of 7.5, this vulnerability represents a high risk that requires immediate attention to prevent unauthorized data exposure.

Immediate Action: As no patch is currently confirmed, administrators should immediately deactivate and remove the Clearblue Ovulation Calculator plugin from their WordPress environments until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or attempts to include system files like etc/passwd in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common file inclusion attack strings and restrict access to sensitive system paths.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of local file inclusion, this vulnerability should be treated with urgency. Organizations should prioritize the removal of the vulnerable plugin to eliminate the attack surface entirely, as there is currently no verified patch available. Continued monitoring of logs is recommended until the software is either updated to a secure version or permanently replaced.