A critical local file inclusion vulnerability in the ThimPress LearnPress Export Import plugin allows unauthenticated attackers to potentially read sensitive files on the host server.

The plugin suffers from an improper control of filename for include or require statements, which is classified as CWE-98. This flaw permits an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized disclosure of sensitive server information.

The ability to perform local file inclusion poses a severe risk to the confidentiality and integrity of the affected server. By accessing arbitrary files, an attacker could extract configuration files, database credentials, or sensitive system data, which often leads to full system compromise. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that demands immediate attention to prevent unauthorized data exposure.

Immediate Action: Since a specific patch version is not currently identified in the provided data, administrators should immediately disable or uninstall the LearnPress Export Import plugin until a secure update is released by ThimPress.

Proactive Monitoring: Security teams should monitor server access logs for suspicious request patterns, specifically looking for directory traversal attempts or unusual file access paths targeting the web directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion signatures and suspicious input parameters that attempt to manipulate file paths.

Public Exploit Available: No (no confirmed public exploit or weaponized module identified).

Given the potential for unauthorized file access and the high CVSS severity, this vulnerability should be treated with urgency. Administrators must prioritize the removal or containment of the affected plugin until a vendor-verified patch is available. Please continue to monitor the vendor advisory for updates regarding the release of a secure version.