This vulnerability (CVE-2025-32159) affects RadiusTheme Radius Blocks up to version 2.2.1. It arises from improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. The issue allows an attacker with limited privileges to include local files, which can result in code execution, data disclosure, or denial of service. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or official fix details are currently available, and the vulnerability is not related to a cloud service.

Successful exploitation can lead to local file inclusion, enabling attackers to execute arbitrary PHP code, disclose sensitive information, or disrupt service availability on affected installations of Radius Blocks. The vulnerability impacts confidentiality, integrity, and availability with high severity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to affected systems, applying strict input validation where possible, and monitoring for unusual activity related to file inclusion attempts. Avoid using vulnerable versions of Radius Blocks in production environments if feasible.