What is the CVSS score of CVE-2026-32400?

CVE-2026-32400 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-32400?

Within 24 hours: Identify all systems running Boldman version 7.7 or earlier and assess exposure to untrusted user input. Within 7 days: Implement compensating controls including WAF rules to block malicious file inclusion attempts and restrict application file access permissions. Within 30 days: Contact ThemetechMount for patch availability, plan upgrade strategy to a patched version, and conduct file access audit to detect potential exploitation.

PHP CVE-2026-32400

EUVD-2026-11917 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-13 Patchstack

PHP WordPress Information Disclosure LFI Boldman Wordpress Theme Themetechmount

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as low-privilege user
Delivery

Craft malicious file inclusion request
Exploit

Manipulate filename parameter
Execution

Include arbitrary local files
Impact

Execute PHP code

Vulnerability Assessment

Weakness	CWE CWE-98 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V5 - File Handling File inclusion prevention, allowlisting MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Authenticated user access required (PR:L). ThemetechMount Boldman version <= 7.7 with improper filename validation in include/require statements. Attacker must be registered user with login credentials.
Impact	The CVSS 3.1 score of 7.5 indicates a high severity vulnerability with network-based attack vector (AV:N), high attack complexity (AC:H), and low privilege requirements (PR:L). The high complexity rating suggests exploitation requires specific conditions or configurations to be successful. Without EPSS data available and no current KEV listing, this appears to be a vulnerability with limited real-world exploitation evidence. The requirement for authenticated access (even with low privileges) and high attack complexity significantly reduces the practical risk compared to unauthenticated vulnerabilities. The technical impact is severe if successfully exploited (C:H/I:H/A:H), but the exploitation barriers make this a medium-priority issue for most organizations unless they specifically use the affected Boldman theme.
Exploit ScenarioDerived	An attacker with low-level authenticated access to a WordPress site running the vulnerable Boldman theme could craft malicious requests to include local system files through manipulated parameters passed to the theme's file inclusion functions. Due to the high attack complexity, the attacker would need to identify the specific vulnerable endpoint and potentially bypass certain security configurations. Once successful, they could read sensitive files like wp-config.php containing database credentials, or potentially achieve remote code execution by combining this with other techniques such as log poisoning or file upload vulnerabilities.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

A PHP remote file inclusion vulnerability exists in the ThemetechMount Boldman theme that allows attackers to include arbitrary local files, potentially leading to remote code execution. The vulnerability affects all Boldman theme versions up to and including version 7.7, enabling authenticated attackers with low privileges to compromise the system through malicious file inclusion. While not currently listed in CISA's KEV catalog, the vulnerability has a moderate CVSS score of 7.5 and requires some attack complexity to exploit successfully.

RemediationAI

The primary remediation is to upgrade the Boldman theme to a version newer than 7.7, though the specific patched version number is not provided in the available data. Organizations should contact ThemetechMount directly or check their WordPress dashboard for theme updates. As immediate mitigation, administrators should restrict access to WordPress admin areas through IP allowlisting, implement Web Application Firewall (WAF) rules to block file inclusion attempts, and audit file upload permissions. Additionally, disabling PHP execution in upload directories and implementing proper input validation at the application level can help prevent exploitation attempts.

Affected VersionsENISA

Boldman n/a ≤≤ 7.7

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as CWE-98, which represents improper control of filename for include/require statements in PHP programs, commonly known as PHP Remote File Inclusion (RFI) or Local File Inclusion (LFI). The Boldman theme, a WordPress theme product by ThemetechMount, fails to properly sanitize user-controlled input that is passed to PHP include() or require() functions. This allows attackers to specify arbitrary file paths, potentially including sensitive system files or uploading malicious PHP code. The vulnerability specifically manifests as a Local File Inclusion (LFI) variant, despite the CVE description mentioning both RFI and LFI, which typically occurs when user input is concatenated into file paths without proper validation or sanitization.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through <= 7.7.

Executive ViewAI

Why It Matters

A Local File Inclusion vulnerability in ThemetechMount Boldman (versions 7.7 and earlier) could allow attackers to access sensitive files on affected systems, potentially exposing confidential data and system configurations. Organizations using this software face immediate risk of data breach and unauthorized system access until remediation is completed.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to filter PHP include/require statements with suspicious parameters; restrict application-level file permissions to prevent access to sensitive system files; disable PHP allow_url_include and allow_url_fopen directives if not required; segment affected systems from sensitive data repositories; implement strict input validation and output encoding; monitor file access logs for suspicious activity.

Threat Intelligence Overview

EPSS Score

0.1%

Top 83% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Local File Inclusion HIGH

Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.