WordPress Plugin WP with Spritz Remote File Inclusion Vulnerability

A remote file inclusion vulnerability has been identified in the WordPress Plugin WP with Spritz, version 1.0. This vulnerability allows unauthenticated attackers to read arbitrary files by injecting file paths into the 'url' parameter. Exploitation involves sending GET requests to 'wp.spritz.content.filter.php' with malicious 'url' values, potentially accessing sensitive files such as system configuration and credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, including system configuration and credentials.

Reproduction

To reproduce this vulnerability, send a GET request to 'wp.spritz.content.filter.php' with a crafted 'url' parameter that points to an arbitrary file, such as '/etc/passwd'. The server will respond with the contents of the specified file, demonstrating the file inclusion vulnerability.