The Verdure Core WordPress plugin is susceptible to a Local File Inclusion vulnerability that could allow unauthorized access to sensitive system files.

This is a Local File Inclusion (LFI) vulnerability (CWE-98). It occurs because the plugin improperly controls filenames used in include or require statements, allowing an attacker to include arbitrary files from the server.

An LFI vulnerability can lead to the exposure of sensitive configuration files, credentials, or other internal data. With a CVSS score of 8.1, this represents a significant threat to data confidentiality and could serve as a precursor to further system exploitation.

Immediate Action: Update the Verdure Core plugin to the latest version to address the file inclusion flaw.

Proactive Monitoring: Monitor server logs for directory traversal patterns (e.g., ../) or attempts to access unexpected file paths within the WordPress installation.

Compensating Controls: Use a WAF to block requests that contain path traversal sequences or attempts to access restricted system files.

Public Exploit Available: Unknown.

Administrators must treat this LFI vulnerability with high urgency. Ensure that the Verdure Core plugin is updated to the latest version immediately to mitigate the risk of unauthorized file access and potential system-wide compromise.