CVE-2025-49921
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.
Analysis
Local file inclusion vulnerability in Crocoblock JetReviews WordPress plugin (versions ≤3.0.0) allows unauthenticated remote attackers to read arbitrary files from the server filesystem via improper filename control in PHP include/require statements. The vulnerability carries moderate real-world risk with EPSS exploitation probability of 0.13% (33rd percentile), indicating relatively low attacker interest despite the network-accessible attack vector requiring no privileges. No public exploit identified at time of analysis, and no active exploitation confirmed.
Technical Context
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a class of PHP code injection flaws where user-controlled input influences file paths passed to include(), require(), or similar PHP language constructs. Despite the CVE description mentioning 'PHP Remote File Inclusion' in the title, the actual classification and tags indicate Local File Inclusion (LFI), which restricts attackers to reading files already present on the server rather than executing arbitrary remote code. The JetReviews plugin, developed by Crocoblock for WordPress review management functionality, fails to properly sanitize or validate filename parameters before using them in file inclusion operations. This allows path traversal sequences (e.g., '../../../') to escape intended directories and access sensitive configuration files, credentials, or application source code. The vulnerability was identified by Patchstack security researchers through their WordPress plugin audit program.
Affected Products
The vulnerability affects Crocoblock JetReviews plugin for WordPress, specifically all versions from the initial release through version 3.0.0 inclusive. JetReviews is a commercial WordPress plugin providing advanced review management, ratings display, and testimonial functionality for WooCommerce and custom post types. Organizations using JetReviews ≤3.0.0 in their WordPress installations should consider themselves affected. The vendor Crocoblock markets this as part of their suite of Elementor-compatible plugins, primarily targeting e-commerce and business websites requiring customer review capabilities. Detailed technical analysis and vulnerability confirmation is available in the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-0-local-file-inclusion-vulnerability.
Remediation
Organizations should immediately upgrade JetReviews to a patched version newer than 3.0.0 if available from Crocoblock. Check the official Crocoblock website or WordPress plugin repository for the latest secure release addressing this LFI vulnerability. If an updated version is not yet released or deployment is delayed, implement compensating controls including: restricting wp-admin access to trusted IP addresses via web application firewall rules, enabling PHP open_basedir restrictions to limit file access scope, deploying web application firewall rules to block path traversal patterns in HTTP requests, and conducting file integrity monitoring to detect unauthorized access to sensitive configuration files. Review web server access logs for suspicious requests containing '../' sequences or attempts to access wp-config.php and other sensitive files. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-0-local-file-inclusion-vulnerability for additional vendor-specific guidance. If JetReviews is not actively used, consider disabling or removing the plugin entirely until a confirmed patch is deployed.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today