An unauthenticated local file inclusion vulnerability in the WP Cafe Pro plugin allows attackers to read sensitive files or execute code, posing a critical risk to the application.

This is a local file inclusion vulnerability (CWE-98) that permits an unauthenticated attacker to manipulate file paths. This allows the attacker to include and potentially execute files from the local server.

Successful exploitation allows an attacker to read configuration files, source code, or sensitive system files. Given the CVSS score of 9.8, the potential for total system compromise and data exfiltration is high, which could lead to significant operational disruption and data loss.

Immediate Action: Update the WP Cafe Pro plugin to version 3.0.15 or later immediately.

Proactive Monitoring: Inspect web server logs for suspicious URL parameters containing directory traversal sequences, such as "../", which are typical signatures for file inclusion attacks.

Compensating Controls: Implement a WAF to filter requests containing directory traversal characters and restrict file access permissions for the web server user.

Public Exploit Available: No

The vulnerability is highly severe and allows for unauthenticated access to system files. Administrators must apply the update to version 3.0.15 as a matter of urgency to ensure the integrity and confidentiality of the server environment.