This vulnerability in unfoldwp Blogprise arises from improper validation or control of filenames used in PHP include or require statements, leading to PHP Local File Inclusion (LFI). An attacker could exploit this to include unintended files on the server, potentially leading to code execution or information disclosure. The affected versions include all releases up to and including 1.0.9. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary code or disclose sensitive information by including local files on the server. This compromises the confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates regarding patches or official fixes.