The vulnerability CVE-2025-49279 affects unfoldwp's Blogvy product through version 1.0.7. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to include arbitrary files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is network exploitable without privileges or user interaction but requires high attack complexity.

Successful exploitation can result in high impact on confidentiality, integrity, and availability of the affected system. Attackers may read or execute arbitrary files on the server, potentially leading to full system compromise or service disruption. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor unfoldwp's communications for updates. Until a fix is available, restricting access to vulnerable instances and applying strict input validation on include/require parameters may reduce risk.