The AnyComment plugin for WordPress contains a local file inclusion vulnerability that could allow an attacker to execute arbitrary local files on the host server.

The software fails to properly sanitize input used in PHP include or require statements, enabling a local file inclusion attack. This vulnerability is accessible to unauthenticated attackers, as indicated by the CVSS vector AV:N/PR:N.

Successful exploitation of this vulnerability can result in the disclosure of sensitive server files, potential remote code execution, or full compromise of the web application. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to data confidentiality and system integrity, potentially leading to unauthorized access to configuration files or database credentials.

Immediate Action: As no official patch is currently confirmed, users should immediately deactivate and remove the AnyComment plugin from their WordPress environment until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting PHP include functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) payloads and directory traversal attempts directed at the web server.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate administrative intervention. Because the plugin is currently susceptible to local file inclusion, the most effective mitigation is to remove the software from the production environment until a verified fix is provided. Security teams should prioritize the removal of this plugin to prevent potential unauthorized access to the underlying server.