This vulnerability in Qode Qi Blocks arises from improper validation of filenames used in PHP include or require statements, allowing remote attackers to include arbitrary files. The affected versions are up to and including 1.3.2. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or official remediation guidance has been published yet.

Successful exploitation can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. This could allow attackers to execute arbitrary PHP code remotely, potentially taking full control of the web server running Qi Blocks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable Qi Blocks plugin and applying web application firewall rules to block suspicious requests targeting file inclusion. Monitor vendor channels for updates.