The All Bootstrap Blocks WordPress plugin, from versions 1.3.20 through 1.3.31, does not validate a block attribute before using it to build a filesystem path. This omission enables users with contributor-level access or higher to supply a crafted attribute that points to any local file on the server. If the referenced file contains PHP code, the content is executed during page rendering, allowing an attacker to disclose arbitrary files and execute server‑side code.

The flaw affects installations of the All Bootstrap Blocks plugin for WordPress, specifically versions 1.3.20 to 1.3.31. Sites that have the plugin enabled and whose user accounts have contributor or higher permissions are vulnerable. The vulnerability is only exploitable when the plugin’s Lightspeed subsystem is enabled, a feature that is not active by default.

The vulnerability carries a CVSS score of 6.6, indicating moderate severity. Its EPSS score is below 1%, implying a low probability that it will be widely exploited. It is not listed in the CISA KEV catalog. An attacker requires access to a WordPress site running the vulnerable plugin, a contributor or higher level user account, and an enabled Lightspeed subsystem to leverage the flaw and potentially execute arbitrary PHP code.