What is the CVSS score of CVE-2025-49921?

CVE-2025-49921 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of JetReviews are affected by CVE-2025-49921?

Crocoblock JetReviews plugin through version 3.0.0 contains a local file inclusion vulnerability allowing authenticated users with minimal WordPress privileges to read sensitive server files,…

How to fix or mitigate CVE-2025-49921?

Within 24 hours: Identify all WordPress installations using Crocoblock JetReviews and document current plugin version. Within 7 days: Disable or remove the plugin pending vendor patch availability; if removal is not operationally feasible, restrict plugin access to administrator accounts only via user role management. Within 30 days: Monitor Crocoblock security advisories for a patched version and evaluate alternative file review plugins that address this vulnerability class.

JetReviews CVE-2025-49921

HIGH

PHP Remote File Inclusion (CWE-98)

2025-10-22 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.3 (HIGH) 7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 7.3

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.

AnalysisAI

Local file inclusion in Crocoblock JetReviews plugin versions through 3.0.0 allows authenticated attackers with low-level privileges to read arbitrary files on the WordPress server via PHP file inclusion flaws. With EPSS at 0.13% (33rd percentile), exploitation likelihood is currently low. No active exploitation confirmed (not in CISA KEV), but Patchstack has cataloged the vulnerability indicating professional security research attention. Attackers can access sensitive configuration files, credentials, and potentially chain with other vulnerabilities for code execution.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement) in the JetReviews WordPress plugin. JetReviews is part of the Crocoblock ecosystem for adding review functionality to WordPress sites. The flaw occurs when user-controlled input is passed to PHP include/require functions without proper sanitization, allowing traversal sequences (../) or direct file paths to be injected. Despite the CVE title mentioning 'PHP Remote File Inclusion', the description and Patchstack classification confirm this is actually Local File Inclusion (LFI), where attackers can read files already on the server rather than inject remote files. This discrepancy between title and actual vulnerability type is important for accurate remediation.

Affected ProductsAI

Crocoblock JetReviews WordPress plugin versions from earliest release through version 3.0.0 are affected. This is a premium WordPress plugin used for adding review systems to WordPress sites, commonly deployed alongside other Crocoblock components like JetEngine. All WordPress installations running JetReviews at version 3.0.0 or earlier should be considered vulnerable. Vendor advisory and detailed technical analysis available at Patchstack database: https://patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-0-local-file-inclusion-vulnerability?_s_id=cve. No CPE identifier available from NVD data, indicating this may be newly disclosed or pending full NVD enrichment.

RemediationAI

Upgrade JetReviews to a patched version newer than 3.0.0 immediately. Patchstack has cataloged this vulnerability, indicating vendor awareness, but the exact patched version number is not confirmed in available data sources. Check Crocoblock's official update channels and the WordPress plugin repository for the latest JetReviews release. If immediate patching is not feasible, implement these compensating controls: (1) Restrict JetReviews functionality to only trusted administrator accounts by reviewing WordPress user roles and capabilities, noting this significantly reduces plugin utility for membership sites; (2) Enable WordPress file access logging via security plugins or server-level auditing to detect traversal attempts in POST/GET parameters containing '../' sequences; (3) Implement Web Application Firewall rules to block requests with path traversal patterns targeting JetReviews endpoints, though this may cause false positives with legitimate file operations; (4) For high-security environments, temporarily disable the JetReviews plugin until vendor confirmation of patched version, accepting loss of review functionality. Monitor Crocoblock security announcements at https://crocoblock.com for official patch release notifications.