The E2Pdf WordPress plugin is vulnerable to an unauthenticated Local File Inclusion attack, which poses a severe risk of total system compromise.

The plugin fails to properly validate filenames before including them in PHP operations, enabling unauthenticated attackers to perform Local File Inclusion. This allows remote actors to read or execute sensitive files on the host server.

Successful exploitation allows an attacker to access sensitive configuration files or execute arbitrary code on the underlying server. Given the CVSS score of 8.1, this vulnerability is classified as high severity, as it can lead to full site takeover, data exfiltration, and unauthorized administrative access.

Immediate Action: Update the e2pdf plugin to version 1.32.43 or later immediately.

Proactive Monitoring: Review web server access logs for requests containing suspicious path traversal patterns or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion and directory traversal attack signatures.

Public Exploit Available: Unknown

The severity of this Local File Inclusion flaw requires immediate attention. Administrators must prioritize updating the e2pdf plugin to the latest version to prevent potential unauthorized access and code execution.