A high-severity Local File Inclusion vulnerability in the Crocoblock JetReviews plugin allows authenticated attackers to compromise server-side files, posing a significant risk to site integrity.

The vulnerability, categorized as CWE-98, stems from improper control of filenames in include statements within the JetReviews plugin. This flaw allows an authenticated user to perform Local File Inclusion (LFI) attacks, which can lead to the unauthorized disclosure or execution of sensitive server files.

The ability to perform Local File Inclusion presents a severe risk to business operations, as it can lead to full system compromise, data exfiltration, and unauthorized code execution. Given the CVSS score of 7.3, this vulnerability is classified as High severity. Successful exploitation could result in the exposure of sensitive configuration files or credentials, leading to significant reputational damage and potential regulatory non-compliance.

Immediate Action: Since no official patch version is currently identified, administrators should immediately deactivate or uninstall the JetReviews plugin until a secure version is released by the vendor.

Proactive Monitoring: Security teams should audit web server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious file inclusion patterns to mitigate the risk of exploitation.

Public Exploit Available: Unknown

Due to the severity of Local File Inclusion vulnerabilities and the potential for total system impact, immediate action is required to secure the environment. Organizations should prioritize deactivating the affected JetReviews plugin until the vendor provides a verified security update, as this is the only reliable method to eliminate the attack surface for this flaw.