CVE-2025-48332 affects PublishPress Gutenberg Blocks versions up to 3.3.1 and involves improper control of the filename parameter in PHP include/require statements, resulting in a Local File Inclusion vulnerability. This flaw allows attackers to potentially include arbitrary files from the server, which can lead to sensitive information disclosure or code execution depending on the context. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5 (Network attack vector, High attack complexity, No privileges required, Requires user interaction, Unchanged scope, High confidentiality, integrity, and availability impact). No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could lead to local file inclusion on the affected server, potentially exposing sensitive files or enabling further attacks that compromise confidentiality, integrity, and availability of the system. The high CVSS score reflects significant impact if exploited. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected PublishPress Gutenberg Blocks plugin versions (<= 3.3.1) to mitigate risk. Monitor the vendor's communications for updates on patches or official mitigations.