Skip to content
Threat Feed
Subscribe
critical advisory

CozyThemes Rootblox WordPress plugin Local File Inclusion (CVE-2026-112832)

The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.

CVE search metadata

CVE search record: CVE-2026-112832. Severity: critical. CVSS: 9.8. KEV: no. Product: Rootblox (<= 1.0.6). Brief: CozyThemes Rootblox WordPress plugin Local File Inclusion (CVE-2026-112832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-rootblox-lfi/

Triage facts

Revision 1
Applicability
Rootblox (<= 1.0.6)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 22, 12:49 UTC
Vulnerabilities
1 CVE
Source quality
B2Very likely

CVE-2026-112832 is a critical Local File Inclusion (LFI) vulnerability discovered in the CozyThemes Rootblox plugin for WordPress, affecting all versions up to and including 1.0.6. The vulnerability stems from improper control of filename parameters used in PHP include or require statements, allowing unauthenticated attackers to read sensitive files on the server or achieve Remote Code Execution (RCE). As of October 22, 2026, proof-of-concept exploit code is publicly available.

Impact

Successful exploitation allows unauthenticated remote attackers to achieve high confidentiality, integrity, and availability impact, typically resulting in full site compromise through arbitrary PHP code execution or unauthorized access to sensitive application files.

Recommendation

  • Identify all WordPress instances running the 'Rootblox' plugin.
  • Deactivate and uninstall the Rootblox plugin immediately if it is version 1.0.6 or earlier until a secure version is confirmed available by the vendor.
  • Review web server access logs for requests containing path traversal sequences (e.g., ../) targeting PHP file inclusion parameters commonly used by the plugin.

Immediate actions

Inventory and disable Rootblox plugin versions <= 1.0.6 across the environment.

IT Operations 24h

Mitigations

Uninstall or disable the vulnerable Rootblox plugin.

immediate IT Operations

CVE-2026-112832