CozyThemes - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/cozythemes/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 12:49:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCozyThemes Rootblox WordPress plugin Local File Inclusion (CVE-2026-112832)https://feed.craftedsignal.io/briefs/2026-10-rootblox-lfi/Thu, 22 Oct 2026 12:49:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rootblox-lfi/The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.CVE-2026-112832 is a critical Local File Inclusion (LFI) vulnerability discovered in the CozyThemes Rootblox plugin for WordPress, affecting all versions up to and including 1.0.6. The vulnerability stems from improper control of filename parameters used in PHP include or require statements, allowing unauthenticated attackers to read sensitive files on the server or achieve Remote Code Execution (RCE). As of October 22, 2026, proof-of-concept exploit code is publicly available.

Impact

Successful exploitation allows unauthenticated remote attackers to achieve high confidentiality, integrity, and availability impact, typically resulting in full site compromise through arbitrary PHP code execution or unauthorized access to sensitive application files.

Recommendation

  • Identify all WordPress instances running the 'Rootblox' plugin.
  • Deactivate and uninstall the Rootblox plugin immediately if it is version 1.0.6 or earlier until a secure version is confirmed available by the vendor.
  • Review web server access logs for requests containing path traversal sequences (e.g., ../) targeting PHP file inclusion parameters commonly used by the plugin.
]]>criticaladvisorywordpresslfiweb-applicationvulnerability