An unauthenticated local file inclusion vulnerability in the Verdure Core WordPress plugin, rated 8.1 on the CVSS scale, introduces a severe risk of unauthorized file access and code execution.

This vulnerability occurs due to improper input validation in file inclusion functions, which allows an unauthenticated attacker to point the application to unauthorized local files.

The ability for an unauthenticated attacker to include arbitrary files can lead to the exposure of sensitive configuration files or the execution of malicious scripts. This level of access poses a severe threat to the integrity and confidentiality of the entire WordPress environment, necessitating immediate remediation.

Immediate Action: Discontinue use of the vulnerable plugin until a patch is available, or restrict access to the affected site components.

Proactive Monitoring: Monitor server logs for unauthorized access attempts or suspicious file path traversal patterns directed at the plugin directory.

Compensating Controls: Utilize a Web Application Firewall to filter and block requests that attempt to traverse directories or include non-intended local files.

Public Exploit Available: No (unknown)

Because this vulnerability allows for unauthenticated access to system files, it represents a critical security risk. Administrators should immediately audit their use of the Verdure Core plugin and implement the necessary updates or security controls to protect the application environment.