A critical file inclusion vulnerability in the VillaTheme Sales Countdown Timer plugin could allow an authenticated attacker to gain unauthorized access to sensitive local files.

The plugin suffers from improper control of filenames in include statements, leading to Local File Inclusion (LFI). This vulnerability requires the attacker to have low-level authenticated access to the WordPress environment to successfully trigger the flaw.

The ability to perform local file inclusion can lead to the unauthorized disclosure of sensitive server configuration files, credentials, or source code. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to site integrity and data confidentiality, potentially facilitating further system compromise if configuration files are exposed.

Immediate Action: Administrators should immediately update the Sales Countdown Timer plugin to the latest version once a patch is released by VillaTheme. If no update is currently available, the plugin should be deactivated and removed from the production environment until a secure version is verified.

Proactive Monitoring: Security teams should monitor server access logs for suspicious file inclusion patterns, such as directory traversal characters or attempts to access non-public configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and unauthorized file inclusion requests targeting the WordPress plugin directory.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to WordPress installations utilizing the affected plugin. Organizations are strongly advised to audit their plugin inventory immediately and apply the vendor patch as soon as it becomes available to prevent potential file disclosure or further unauthorized system access.