This vulnerability in Crocoblock JetWooBuilder arises from improper validation of filenames used in PHP include or require statements, enabling an attacker to perform Local File Inclusion (LFI). Exploiting this flaw could allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. The affected versions include all releases up to and including 2.1.18. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or access sensitive files by leveraging the improper filename control in PHP include/require statements. The vulnerability is exploitable remotely over the network but requires high attack complexity and limited privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable plugin and monitor for updates from Crocoblock. No vendor advisory or patch links are currently provided.