The vulnerability is a flaw in the Rootblox plugin that allows an attacker to supply a custom filename to a PHP include/require statement. This weakness enables local file inclusion, meaning an attacker could read arbitrary files on the server that the web process can access, resulting in direct exposure of confidential server files. No evidence of privilege escalation or remote code execution is implied by the description.

WordPress sites that have the Rootblox plugin by CozyThemes installed in any version up to and including 1.0.6. The plugin version has been affected from the initial release through 1.0.6.

The CVSS score of 9.8 indicates critical severity. No EPSS score is available, so exploitation probability is unknown but the flaw is exploitable via well‑known techniques and can be triggered by any user who can influence the plugin’s include parameters. The likely attack vector involves a crafted HTTP request that supplies a path to a local file, causing the plugin to include and output that file’s contents. It is not listed in the CISA KEV catalog.