Rootblox EUVD-2026-108139

Exploitation targets the Rootblox WordPress plugin (CozyThemes) at versions from an unspecified start through 1.0.6; the specific plugin feature, endpoint, or parameter that controls the include/require path is not described in the available sources. Per the supplied CVSS vector (PR:N/UI:N) exploitation requires no authentication and no user interaction against a network-reachable install, but this PR:N assertion originates only from the Patchstack-provided CVSS and is not confirmed by the description - many WordPress plugin LFI flaws in practice require some authenticated role. Escalation from file inclusion to code execution additionally depends on the attacker being able to place executable PHP in an includable location. The chief limiting factor is deployment: the plugin has a small install base, and anyone running a version after 1.0.6 is out of scope.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, and the vuln.today Decision label is act_now - signals that argue for prompt remediation. However, the supporting evidence is thin and partly conflicting: CWE-98 formally denotes PHP Remote File Inclusion while both the description and the Tags (LFI) state Local File Inclusion, so the exact mechanism and whether remote URLs can be included is unresolved. No EPSS score, no CISA KEV listing, and no SSVC exploitation/automatable/technical-impact breakdown were supplied, and the single reference is a Patchstack database entry rather than a working exploit. There is therefore no public exploit identified at time of analysis and no evidence of active exploitation. The 9.8 rating is a vendor/coordinator severity assessment of a WordPress plugin with a small real-world footprint; treat it as a genuine high-severity issue to patch, but its real-world risk is tempered by low deployment prevalence and the absence of exploitation-probability data. The PR:N (unauthenticated) assertion comes from the CVSS vector only and is not independently confirmed by the description.

A remote attacker sends a crafted request to the vulnerable Rootblox plugin endpoint supplying attacker-controlled input to a PHP include/require path, causing the plugin to include and execute an unintended local file. If the attacker can seed executable PHP into an includable location (for example via log or upload poisoning), this can escalate from file disclosure to code execution on the WordPress host. No public exploit code was identified in the provided sources; only a Patchstack vulnerability-database reference exists.