The vulnerability is a Local File Inclusion flaw present in bdthemes ZoloBlocks versions up to 2.3.2 caused by improper control of filenames used in PHP include or require statements. An attacker who can influence the include path may read arbitrary files from the web server’s filesystem, potentially exposing passwords, configuration data, or facilitating arbitrary code execution if a writable PHP file is included. The weakness is classified under CWE‑98, which describes improper control of input used for file inclusion.

WordPress sites using the ZoloBlocks plugin by bdthemes that are running any release from the plugin’s initial version through 2.3.2 are affected. Version information beyond the upper bound is not provided, so all releases up to and including 2.3.2 are considered vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability with potential for significant damage. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector would be remote if the plugin provides a publicly accessible entry point that accepts user-controlled input for file inclusion, but this inference is not explicitly stated in the description.