Local File Inclusion in All Bootstrap Blocks Plugin for WordPress
CVE-2026-88994

6.6MEDIUM

Key Information:

Vendor

WordPress
Status
All Bootstrap Blocks
Vendor
CVE Published:
18 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-88994?

The All Bootstrap Blocks plugin for WordPress before version 1.3.32 contains a local file inclusion vulnerability due to improper validation of block attributes used to construct filesystem paths at render time. This flaw enables users with contributor-level access and above to manipulate file paths, potentially leading to the exposure of arbitrary local files or the execution of PHP code contained within those files. This vulnerability necessitates that the plugin's Lightspeed subsystem be enabled, which is not the default setting, thereby modifying typical risk exposure scenarios.

Affected Version(s)

All Bootstrap Blocks 1.3.20 <= 1.3.31

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-88994 - Proof of Concept

References

https://wpscan.com/vulnerability/55b1f0b1-dc15-45d4-beb2-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Revanth Hari Narayana Matte
WPScan
.