WordPress Verdure Core Plugin Local File Inclusion Flaw

The Verdure Core plugin for WordPress contains a Local File Inclusion (LFI) vulnerability that allows unauthenticated attackers to include and execute arbitrary files on vulnerable servers. This vulnerability is particularly dangerous because it requires no authentication, meaning any internet-facing WordPress site running the affected plugin versions (up to 1.2) is immediately at risk. Attackers can leverage this flaw to execute arbitrary PHP code, potentially bypassing access controls, exfiltrating sensitive data including database credentials and configuration files, or establishing persistent backdoor access. Organizations using this plugin face significant exposure, especially if they also permit file uploads—a common feature that compounds the risk by providing attackers with a mechanism to stage malicious files for inclusion.

While this CVE lacks direct MITRE ATT&CK technique mapping, Casky's security skills powered by Claude would detect the underlying attack patterns associated with this vulnerability across multiple threat vectors. Practitioners would identify indicators consistent with Execution (T1059 - Command Line Interface, T1190 - Exploit Public-Facing Application), Defense Evasion (T1070 - Indicator Removal), and Credential Access (T1040 - Network Sniffing) techniques. A Casky analysis would flag suspicious patterns such as requests with file path traversal sequences (../, ..\, encoded variants), unexpected PHP file inclusions in parameter values, POST requests to plugin-specific endpoints with file parameters, and log entries showing execution of files from upload directories. Security teams would see correlated findings linking uploaded files to subsequent code execution, HTTP requests with LFI payloads, and anomalous process spawning—enabling rapid detection and response before exploitation.