CVE-2026-88994: All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
All Bootstrap Blocks (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.3.31 - Configuration
Disable the plugin's Lightspeed subsystem (exploitation requires it to be enabled; it is not enabled by default).
All Bootstrap Blocks (WordPress plugin) - Lightspeed subsystem Lightspeed subsystem enabled = false
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using All Bootstrap Blocks through version 1.3.31 are exposed only if the plugin's Lightspeed subsystem is enabled. Lightspeed is not enabled by default.
What access does an attacker need?
An attacker needs a WordPress account with Contributor-level permissions or higher. No user interaction is required once the attacker has the necessary access.
What could exploitation allow?
An attacker may include arbitrary local files, disclose their contents, and execute PHP if they can reach a local file containing PHP code.