A high-severity Local File Inclusion vulnerability in the WP Customer Area plugin allows unauthenticated attackers to potentially compromise the underlying server environment.

The plugin contains an Improper Control of Filename for Include/Require Statement vulnerability (CWE-98), which permits Local File Inclusion. This flaw can be triggered by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N.

The ability to perform Local File Inclusion poses a significant risk to business operations, as it may allow an attacker to read sensitive configuration files, source code, or potentially execute arbitrary PHP code. With a CVSS score of 7.5, this vulnerability represents a high risk to data confidentiality and system integrity, potentially leading to a complete compromise of the WordPress installation.

Immediate Action: Review the vendor documentation for available security updates and upgrade to a version beyond 8.3.5 if a patch has been released. If no patch is available, consider deactivating the WP Customer Area plugin until a secure version is confirmed.

Proactive Monitoring: Monitor server access logs for unusual requests containing directory traversal sequences (such as ../) or attempts to access sensitive files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and directory traversal attempts, providing a virtual patch layer against exploitation.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for full system compromise via Local File Inclusion, organizations should prioritize the removal or update of this plugin. Administrators must verify the status of the vendor advisory frequently and apply the necessary patches immediately upon release to prevent unauthorized access to the web server.