Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Rootblox plugin can load unintended files

CVE-2026-112832 · published 13 days ago
Summary

The Rootblox plugin for WordPress (versions up to 1.0.6) can be tricked into loading files from the server that it should not access. This could let an attacker read sensitive data or run code on your site. Update the plugin to a newer version or remove it if you do not need it.

What to do
  • Update cozythemes rootblox to version 1.0.7.
Affected software
VendorProductAffected versions
cozythemes rootblox <= 1.0.6
Fix: upgrade to 1.0.7
Original advisory text
WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-98Improper Control of Filename for Include
Timeline
Published22 Oct 2026
Updated4 Nov 2026
First seen22 Oct 2026
Sources
CVE-2026-112832 · NVD
CVE-2026-112832 · MITRE
Track software like this
Free during beta