The ZoloBlocks plugin for WordPress is vulnerable to Local File Inclusion, which could allow an authenticated attacker to execute arbitrary code or access sensitive system files.

This vulnerability, categorized as CWE-98, occurs due to improper control of filenames for include or require statements. An attacker with low-level authenticated access can manipulate these inputs to force the application to include unintended local files.

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress environment. By leveraging Local File Inclusion, an attacker could read sensitive configuration files, such as wp-config.php, or escalate to remote code execution, leading to a full system compromise. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data access or complete site takeover.

Immediate Action: Since no specific patch version is currently confirmed, administrators should monitor the official Patchstack and WordPress plugin repositories for an update that addresses this issue. If a fix is not available, consider temporarily deactivating the ZoloBlocks plugin until a secure version is released.

Proactive Monitoring: Review web server and WordPress access logs for suspicious requests containing path traversal sequences or attempts to access system-level PHP files.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block directory traversal attempts and unauthorized file inclusion patterns.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of the vulnerability, organizations should prioritize the removal or update of the ZoloBlocks plugin. Until a vendor-supplied patch is verified, restricting access to the administrative dashboard and monitoring for unauthorized file system interactions is critical to maintaining a secure posture.