The Premmerce WordPress plugin is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to execute arbitrary local files on the server.

This vulnerability is caused by improper control of filenames in PHP include or require statements. An unauthenticated attacker can exploit this flaw to perform Local File Inclusion, potentially leading to unauthorized data disclosure or code execution.

Successful exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress site. With a CVSS score of 7.5, this high-severity flaw could allow an attacker to read sensitive configuration files or execute arbitrary scripts on the underlying server, potentially leading to a full system compromise.

Immediate Action: Since a specific patch version is not confirmed, users should immediately deactivate and uninstall the Premmerce plugin if it is not essential for business operations. Monitor the vendor advisory closely for the release of a secure version.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file path inclusions. Monitor for unusual system-level process execution originating from the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious PHP include patterns. Ensure that the web server is running with the principle of least privilege to limit the impact of file inclusion.

Public Exploit Available: Unknown.

Given the potential for full system compromise, this vulnerability should be treated with high priority. Organizations using the Premmerce plugin must verify their current version and take immediate steps to restrict or remove the component until a verified security update is provided by the vendor.