CVE-2026-112832

CriticalCVSS 9.8

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Summary

The CozyThemes Rootblox WordPress plugin through version 1.0.6 contains an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability that allows PHP Local File Inclusion.

Risk Assessment

An attacker may force inclusion of unintended PHP files, potentially leading to data disclosure or code execution in the context of the WordPress application. The risk applies to sites running the vulnerable plugin version.

Recommendation

Update the Rootblox plugin to a version later than 1.0.6 or remove it if it is not in use.

Other vulnerabilities in Rootblox

CVE-2026-111843Medium
The WordPress Rootblox plugin through 1.0.7 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This may allow injection of a malicious script that is stored and executed by other users.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS