The Favorites plugin for WordPress is vulnerable to local file inclusion, which may allow an unauthenticated attacker to execute arbitrary code or access sensitive files.

This vulnerability, categorized as CWE-98, occurs when user-supplied input is improperly sanitized before being used in PHP file inclusion functions. The CVSS vector indicates that the attack vector is network-based and requires no authentication, though it does involve user interaction.

A successful exploit of this vulnerability could lead to a complete compromise of the underlying application, as local file inclusion often allows for the execution of arbitrary PHP code. Given the CVSS score of 7.5, this is a high-severity issue that could result in unauthorized access to sensitive configuration files, database credentials, or full system takeover.

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately deactivate and remove the Favorites plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to include non-plugin files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts.

Public Exploit Available: Unknown.

Due to the potential for remote code execution and unauthorized file access, this vulnerability presents a significant risk to the integrity and confidentiality of the host WordPress environment. Organizations currently utilizing the Favorites plugin are advised to prioritize its removal until the developer provides a verified security patch.