This vulnerability in spicethemes Spice Blocks (versions up to 2.0.7.4) involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. This allows an attacker to craft requests that access files outside the designated directory boundaries, potentially exposing sensitive information. The CVSS 3.1 score of 7.5 reflects a high severity due to the ability to exploit remotely without authentication and cause high confidentiality impact without affecting integrity or availability.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected system, compromising confidentiality. There is no indication of impact on integrity or availability. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to path traversal attempts. Avoid exposing the application to untrusted networks if possible.