Vulnerability in All Bootstrap Blocks
CVE-2026-88994
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Unknown All Bootstrap Blocks
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-88994?
- CVE-2026-88994 is a medium-severity vulnerability in All Bootstrap Blocks, classified under PHP Remote File Inclusion. CVSS score: 6.6/10. Published 2026-09-18.
- How severe is CVE-2026-88994?
- Medium severity. CVSS v3 base score is 6.6 out of 10.