The vulnerability CVE-2025-39396 affects Crocoblock JetReviews plugin versions up to 2.3.6. It arises from improper validation or control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges and no user interaction to execute unauthorized code or access sensitive files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could result in local file inclusion, potentially allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The high CVSS score reflects the potential for significant confidentiality, integrity, and availability impacts. However, no active exploitation has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Crocoblock's communications for updates. Applying strict input validation or disabling vulnerable functionality may reduce risk but should be guided by vendor recommendations.