The Simple Payment plugin for WordPress is vulnerable to remote file inclusion, which could allow an unauthenticated attacker to achieve remote code execution.

This vulnerability is a Remote File Inclusion (CWE-98) flaw occurring within the Simple Payment plugin. It allows an unauthenticated attacker to manipulate file paths used in include or require statements, potentially leading to the execution of malicious scripts.

Successful exploitation of this vulnerability poses a significant risk to the integrity, confidentiality, and availability of the host WordPress environment. With a CVSS score of 7.3, this high-severity flaw enables attackers to execute arbitrary code on the server, which can lead to complete site compromise, data exfiltration, or the deployment of further malware.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the Simple Payment plugin until an official security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing suspicious file paths or attempts to access non-existent PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common file inclusion attack patterns, such as directory traversal characters or remote URL inclusion attempts.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the nature of file inclusion vulnerabilities, users of the Simple Payment plugin must prioritize containment. Deactivation is the only reliable method to eliminate the attack surface at this time. Monitor vendor communication channels closely for the release of a patched version before considering re-enabling the plugin.