The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion, which enables authenticated attackers to execute arbitrary code and gain unauthorized system access.

This vulnerability involves improper control of filenames for include statements within the bizcalv shortcode. It requires an attacker to possess at least Contributor-level authentication to trigger the file inclusion and subsequent code execution.

Successful exploitation allows an attacker to execute arbitrary PHP code, potentially leading to a full compromise of the WordPress environment. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data exfiltration, unauthorized modification of site content, and potential lateral movement within the hosting infrastructure.

Immediate Action: Administrators must update the BizCalendar Web plugin to the latest version immediately to patch the vulnerable shortcode implementation.

Proactive Monitoring: Security teams should review server logs for suspicious requests involving the bizcalv shortcode or attempts to include unexpected file paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious input patterns, such as directory traversal characters, in URL parameters and shortcode attributes.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk to the integrity and availability of the affected WordPress site. Administrators are urged to verify their plugin version and apply the vendor-supplied update without delay. If an update is not immediately feasible, consider deactivating the BizCalendar Web plugin until the patch can be safely deployed.