CVE-2026-112832: WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Rootblox pluginto a version that resolves this vulnerability.Fixed in 1.0.7
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is rated network-accessible with low attack complexity and requires no privileges or user interaction. This indicates an unauthenticated remote attacker may be able to exploit an affected installation.
Which Rootblox versions are affected?
Rootblox versions through 1.0.6 are affected. The available information does not identify a fixed version.
What is the potential impact of successful exploitation?
The severity vector indicates high potential impact to confidentiality, integrity, and availability. The issue is a PHP local file inclusion vulnerability, which may allow an attacker to include local files.