{"id":"CVE-2026-112832","published":"2026-10-22T11:17:33.163","lastModified":"2026-10-22T15:15:23.833","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/rootblox/vulnerability/wordpress-rootblox-plugin-1-0-6-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The vulnerability is a PHP Remote File Inclusion (RFI) flaw caused by improper filename control in CozyThemes Rootblox versions up to and including 1.0.6, allowing attackers to include and execute arbitrary remote PHP files via user-supplied input.","exploitability":"Exploitation is straightforward for remote attackers since it requires no authentication, minimal privileges, and can be triggered over the network without user interaction.","blast_radius":"Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across any environment where the vulnerable Rootblox instance is exposed.","remediation":"Upgrade to CozyThemes Rootblox version 1.0.7 or later, as this is the first fixed version addressing CVE-2026-112832.","detection":"Defenders may observe HTTP requests containing suspicious file paths in include/require parameters (e.g., URLs with .php?file= patterns pointing to external domains), especially when such requests result in unexpected PHP execution or unusual outbound connections to unknown domains. If the application does not log request parameters or response behavior, no reliable indicator may be present.","tags":["rfi","php","webapp","remote-code-execution","file-inclusion"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:57:29.026Z"}}