The vulnerability CVE-2025-53210 affects bdthemes ZoloBlocks versions up to 2.3.2 and involves improper control of the filename parameter in PHP include/require statements. This weakness can lead to PHP Local File Inclusion, where an attacker might cause the application to include unintended local files, potentially leading to code execution or information disclosure. The CVSS 3.1 score of 7.5 reflects high impact with network attack vector, high confidentiality, integrity, and availability impacts, but requires low privileges and high attack complexity.

Successful exploitation of this vulnerability could allow an attacker with low privileges to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or disruption of service. The high CVSS score indicates that confidentiality, integrity, and availability could all be significantly affected. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users of bdthemes ZoloBlocks should monitor vendor communications for updates. Until a fix is available, restricting access to the vulnerable functionality and applying web application firewall rules to block suspicious include/require requests may help mitigate risk.