When “Unauthenticated LFI” Isn’t: The Hidden Cost of Vulnerability Feeds

Security alerts are supposed to make systems safer. But sometimes they do something else: they quietly consume hours of engineering time investigating issues that turn out to be exaggerated or practically unexploitable. Recently, I spent a full day triaging one such vulnerability report. The alert flagged a serious issue in a WordPress plugin—an Unauthenticated Local File Inclusion (LFI)…