This vulnerability in Automattic Jetpack CRM (zero-bs-crm) arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion (LFI). Affected versions include all up to 6.7.0. The issue allows attackers to potentially include local files on the server, which may lead to sensitive data exposure or other impacts. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor or other sources. The vulnerability is published and tracked under CVE-2026-22356.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server running Jetpack CRM, potentially exposing sensitive information or enabling further attacks that compromise confidentiality, integrity, and availability of the affected system. The CVSS score of 7.5 indicates a high impact. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for suspicious activity. Avoid exposing the application to untrusted users. Follow vendor channels for updates on patches or official mitigations.