What is the CVSS score of CVE-2026-32400?

CVE-2026-32400 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-32400?

A Local File Inclusion vulnerability in ThemetechMount Boldman (versions 7.7 and earlier) could allow attackers to access sensitive files on affected systems, potentially exposing confidential data…

How to fix or mitigate CVE-2026-32400?

Within 24 hours: Identify all systems running Boldman version 7.7 or earlier and assess exposure to untrusted user input. Within 7 days: Implement compensating controls including WAF rules to block malicious file inclusion attempts and restrict application file access permissions. Within 30 days: Contact ThemetechMount for patch availability, plan upgrade strategy to a patched version, and conduct file access audit to detect potential exploitation.

PHP CVE-2026-32400

EUVD-2026-11917 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-13 Patchstack

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11917

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through <= 7.7.

AnalysisAI

A PHP remote file inclusion vulnerability exists in the ThemetechMount Boldman theme that allows attackers to include arbitrary local files, potentially leading to remote code execution. The vulnerability affects all Boldman theme versions up to and including version 7.7, enabling authenticated attackers with low privileges to compromise the system through malicious file inclusion. While not currently listed in CISA's KEV catalog, the vulnerability has a moderate CVSS score of 7.5 and requires some attack complexity to exploit successfully.

Technical ContextAI

This vulnerability is classified as CWE-98, which represents improper control of filename for include/require statements in PHP programs, commonly known as PHP Remote File Inclusion (RFI) or Local File Inclusion (LFI). The Boldman theme, a WordPress theme product by ThemetechMount, fails to properly sanitize user-controlled input that is passed to PHP include() or require() functions. This allows attackers to specify arbitrary file paths, potentially including sensitive system files or uploading malicious PHP code. The vulnerability specifically manifests as a Local File Inclusion (LFI) variant, despite the CVE description mentioning both RFI and LFI, which typically occurs when user input is concatenated into file paths without proper validation or sanitization.

RemediationAI

The primary remediation is to upgrade the Boldman theme to a version newer than 7.7, though the specific patched version number is not provided in the available data. Organizations should contact ThemetechMount directly or check their WordPress dashboard for theme updates. As immediate mitigation, administrators should restrict access to WordPress admin areas through IP allowlisting, implement Web Application Firewall (WAF) rules to block file inclusion attempts, and audit file upload permissions. Additionally, disabling PHP execution in upload directories and implementing proper input validation at the application level can help prevent exploitation attempts.