{"id":"CVE-2026-112832","kind":"vulnerability","aliases":["CVE-2026-112832"],"related":[],"title":"Rootblox WordPress theme: PHP file inclusion lets attackers run server files","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.","summary":"The Rootblox WordPress theme by CozyThemes includes a file based on a filename the visitor controls. An attacker can make the server include and run local PHP files, which can expose secrets or lead to code execution.","severity":"critical","cvss":9.8,"epss":0.0044,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","rootblox","wordpress"],"not_affected_if":["theme-not-installed","version-1.0.7-or-later"],"how_to_check":"Check the installed Rootblox theme version in the WordPress admin under Appearance > Themes, or read the style.css header of the theme folder.","fix":"Update Rootblox to a version later than 1.0.6, or remove the theme if no fixed release is available.","status":"open","published_at":"2026-10-22T11:17:33+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:28+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:32:28Z","model":"claude-haiku-5-5","output":{"fix":"Update Rootblox to a version later than 1.0.6, or remove the theme if no fixed release is available.","reach":"internet","title":"Rootblox WordPress theme: PHP file inclusion lets attackers run server files","impact":"high","summary":"The Rootblox WordPress theme by CozyThemes includes a file based on a filename the visitor controls. An attacker can make the server include and run local PHP files, which can expose secrets or lead to code execution.","category":"package","who_cares":["wordpress","rootblox","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs server-side PHP files and reads secrets such as wp-config.php","analyst_note":"Confirm the exact affected version range and whether a fixed release exists; the NVD entry gives only 'through 1.0.6' and the vendor advisory is not in the sources.","how_to_check":"Check the installed Rootblox theme version in the WordPress admin under Appearance > Themes, or read the style.css header of the theme folder.","needs_analyst":true,"not_affected_if":["theme-not-installed","version-1.0.7-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000508,"input_tokens":2923,"output_tokens":431,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112832':14A,17A '-2026':13A,16A '1.0.6':89C 'affect':84C 'allow':78C 'attack':8A,39B 'base':31B 'code':57B 'control':37B,60C 'cozythem':27B,75C 'cve':12A,15A 'execut':58B 'expos':52B 'file':5A,11A,30B,49B,71C,81C 'filenam':34B,62C 'improp':59C 'includ':28B,44B 'include/require':64C 'inclus':6A,72C 'inclusion.this':82C 'issu':83C 'lead':55B 'let':7A 'local':47B,80C 'make':41B 'n/a':87C 'packag':18B 'php':4A,19B,48B,67C,69C,79C 'program':68C 'remot':70C 'rootblox':1A,20B,23B,76C,77C,85C 'run':9A,46B 'secret':53B 'server':10A,43B 'statement':65C 'theme':3A,25B 'visitor':36B 'vulner':73C 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112832","severity":null,"published_at":"2026-10-22T11:17:33+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112832","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112832","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}