Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88994

All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

CVSS 3.1 6.6 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88994

Published

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled, which is not the default.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88994

Published

All Bootstrap Blocks

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "All Bootstrap Blocks",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.3.20",
                            "lessThanOrEqual": "1.3.31"
                        }
                    ],
                    "defaultStatus": "unknown",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON