A high severity local file inclusion vulnerability in the MagicAI for WordPress plugin allows authenticated subscribers to execute arbitrary files on the server.

This is a local file inclusion vulnerability, categorized under CWE-98, where the application fails to properly sanitize input used in include or require statements. The flaw is exploitable by an authenticated user with subscriber level privileges.

An attacker can leverage this vulnerability to include sensitive server files, potentially leading to the disclosure of configuration data, credentials, or source code. With a CVSS score of 8.8, this vulnerability represents a significant risk to the entire WordPress environment, as it may facilitate further exploitation and complete server compromise.

Immediate Action: Update the MagicAI for WordPress plugin to a version beyond 1.4 if available, or disable the plugin until a security update is released by LiquidThemes.

Proactive Monitoring: Review web server access logs for requests containing unexpected file paths or directory traversal sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion patterns and directory traversal attempts.

Public Exploit Available: false

Users of the MagicAI for WordPress plugin should prioritize patching this vulnerability to prevent unauthorized file access. If a patch is not yet provided by the vendor, removing the plugin is the only effective way to eliminate the exposure until a secure version is released.