Live › vulnerability › CVE-2026-112832
Go to dashboardThe Rootblox WordPress theme by CozyThemes includes a file based on a filename the visitor controls. An attacker can make the server include and run local PHP files, which can expose secrets or lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Rootblox theme version in the WordPress admin under Appearance > Themes, or read the style.css header of the theme folder.
Update Rootblox to a version later than 1.0.6, or remove the theme if no fixed release is available.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-112832")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.