A Local File Inclusion vulnerability in the Advanced Database Cleaner – Premium plugin for WordPress poses a significant risk of unauthorized file system access.

This vulnerability is a Local File Inclusion (LFI) flaw that may allow an attacker to include arbitrary files on the server. The specific authentication requirements are not explicitly stated, but LFI vulnerabilities in WordPress plugins often bypass standard access controls.

Successful exploitation of this vulnerability could lead to the exposure of sensitive configuration files, credentials, or source code, resulting in complete system compromise. With a CVSS score of 8.8, this flaw represents a high risk to business operations, potentially leading to data breaches and the loss of site integrity.

Immediate Action: Update the Advanced Database Cleaner – Premium plugin to the latest available version provided by the vendor. If an update is not currently available, consider disabling or removing the plugin until a secure version is released.

Proactive Monitoring: Monitor server logs for suspicious file inclusion patterns, such as directory traversal characters (e.g., ../) in URL parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common Local File Inclusion attack vectors.

Public Exploit Available: false

Given the high CVSS score, administrators should treat this vulnerability with high priority. Ensure that the plugin is patched immediately upon the release of a security update by the vendor to prevent potential unauthorized access to the underlying server.