External risk intelligence

Rootblox PHP Local File Inclusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-112832

This vulnerability affects a WordPress plugin, which is a component of a web application. Web applications and their plugins are typically deployed as public-facing services accessible via the internet, making the vulnerable code path reachable by external users.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Rootblox plugin for PHP applications allows for unauthorized file inclusion, potentially enabling attackers to access or modify sensitive data remotely. This issue, rated as critical, underscores the importance of maintaining the security of web application components.

A code flaw lets attackers include unintended files.
It can impact web application integrity and data.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a web application using the affected plugin into processing a specially crafted request. This could allow them to include arbitrary local files, potentially leading to the execution of malicious code or the exposure of sensitive information.

Requires no authentication to trigger.
Triggered by a crafted request to the plugin.
Leads to local file inclusion.

Live Threat

Current exploitation, exposure, and threat context

A PHP Local File Inclusion vulnerability in Rootblox could allow an unauthenticated attacker to include arbitrary local files from the server. This could lead to the disclosure of sensitive information or other system impacts, depending on the files that can be accessed and the permissions of the web server process.

Local configuration files could be exposed.
Remote file inclusion via crafted requests.
Potential for sensitive data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Rootblox plugin for PHP File Inclusion requires immediate attention from teams managing web applications, particularly those responsible for the CozyThemes Rootblox product and the underlying WordPress infrastructure. The first practical step is to identify all instances of Rootblox, determine their exposure to external networks, and confirm business criticality to prioritize remediation efforts.

Application owners should lead remediation.
Verify external reachability and business impact.
Coordinate vendor updates and testing.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Rootblox plugin?

Rootblox is a PHP-based software component, specifically a WordPress plugin developed by CozyThemes. It is typically used to extend the functionality of web applications. Like many plugins, it integrates directly into the site's code to provide custom features or content management capabilities.

What does PHP Local File Inclusion mean for CVE-2026-112832?

This vulnerability falls under the weakness class of Improper Control of Filename for Include/Require Statement, known as CWE-98. It means the plugin does not properly validate user input before using it to load files. Consequently, an attacker can manipulate the plugin into reading or executing unintended files stored on the server.

How is this Rootblox vulnerability triggered?

An attacker triggers this bug by sending a specially crafted request to the web application. Because the plugin fails to sanitize these inputs, it may process the malicious request by including local files. It is not triggered by standard, legitimate user interactions with the site's normal interface.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is likely relevant to you because Rootblox is a WordPress plugin. Such components are commonly deployed as public-facing services, meaning the vulnerable code path is often accessible to anyone on the internet, which increases the potential for unauthorized access.

What should I do if I use Rootblox?

Begin by creating an inventory of all systems running the Rootblox plugin. Once identified, evaluate whether these systems are reachable from the internet or restricted to internal networks. Work with your technical team to prioritize these assets based on their business criticality while monitoring for vendor-provided updates.

References

patchstack.com/database/wordpress/plugin/rootblox/vulnerability/word…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.