This vulnerability in Crocoblock JetReviews (<= 3.0.0) arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. An attacker with network access and low privileges can exploit this to include arbitrary files on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with high attack complexity and no required user interaction. No vendor advisory or patch information is currently available.

Successful exploitation can lead to local file inclusion on the server running JetReviews, which may allow attackers to read sensitive files, execute arbitrary code, or disrupt service, impacting confidentiality, integrity, and availability. The high CVSS score indicates significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected application and monitor for suspicious activity related to file inclusion attempts.