CVE-2026-88994

Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks WordPress plugin versions prior to 1.3.32

Description The plugin fails to validate a block attribute used to construct a filesystem path during rendering. This allows users with contributor-level access or higher to perform local file inclusion, leading to the disclosure of file contents or remote code execution if a local file containing PHP code is accessed. This issue is only exploitable when the Lightspeed subsystem is enabled.

Recommendations Update the All Bootstrap Blocks WordPress plugin to version 1.3.32 or later. Disable the Lightspeed subsystem to prevent exploitation.