The JetReviews plugin for WordPress improperly controls the filename used in PHP include/require statements, which can be manipulated to include arbitrary local files on the server. This flaw is a classic LFI issue (CWE‑98) that could expose configuration files, credentials, or enable arbitrary code execution if attacker‑controlled code can be included. The impact is direct compromise of confidentiality and potential integrity or availability if a malicious file is executed.

All installations of Crocoblock JetReviews version 3.0.0 or earlier are affected. The vulnerability applies to the JetReviews plugin deployed on any WordPress site that uses these versions.

The CVSS score is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via a public web request to the plugin’s interface, with minimal authentication requirements; the exact vector is inferred from the fact that the flaw resides in a publicly accessible plugin component.