The JetReviews WordPress plugin in versions up to 2.3.6 includes an improper control of filename issue that allows a local file inclusion vulnerability. An attacker may be able to manipulate the include/require path in PHP to read sensitive files or execute arbitrary code if the included file contains executable code. This weakness corresponds to CWE‑98 and can compromise the confidentiality and integrity of the affected system.

The vulnerability affects the JetReviews plugin from Crocoblock, versions n/a through 2.3.6. Any WordPress site that has a JetReviews installation at or below this version is potentially exposed.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated or authenticated user submitting a specially crafted request that causes the plugin to include a local file. Successful exploitation could allow read access to restricted files or remote code execution if the included local file contains PHP code.