What is the CVSS score of CVE-2026-32500?

CVE-2026-32500 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-32500?

CVE-2026-32500 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-32500?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-32500

EUVD-2026-15849 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-xwq3-q3mj-2j47

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15849

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS MetaMax metamax allows PHP Local File Inclusion.This issue affects MetaMax: from n/a through <= 1.1.4.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in CreativeWS MetaMax theme versions up to and including 1.1.4, allowing attackers to include and execute arbitrary local files through improper handling of PHP include/require statements. An unauthenticated remote attacker can exploit this to disclose sensitive files, read configuration data containing credentials, or potentially achieve remote code execution by including files with executable content. While no CVSS score or EPSS data is currently available, the vulnerability has been confirmed and documented by Patchstack with a direct reference to the affected WordPress theme.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), which occurs when a PHP application fails to properly validate or sanitize user-supplied input before using it in PHP include(), require(), include_once(), or require_once() functions. In the MetaMax theme (CPE: cpe:2.3:a:creativews:metamax:*:*:*:*:*:*:*:*), this flaw allows attackers to manipulate file path parameters to include local files from the server's filesystem. The root cause is insufficient input validation on filename parameters, enabling traversal attacks (e.g., using '../' sequences) or direct specification of sensitive files like /etc/passwd, wp-config.php, or other configuration files containing database credentials and API keys. This is distinct from Remote File Inclusion (RFI) but equally dangerous, as local files often contain sensitive application state and secrets.

RemediationAI

Users must upgrade CreativeWS MetaMax to a version newer than 1.1.4 as soon as a patch is available; check the Patchstack database and official CreativeWS vendor channels for the patched version. Until a patch is released or applied, implement the following mitigations: disable or restrict access to MetaMax theme files via web server configuration (e.g., deny direct access to theme directories in .htaccess or nginx config), implement Web Application Firewall (WAF) rules to detect and block LFI payloads (patterns containing '../', 'etc/passwd', 'wp-config', etc.), audit server logs for suspicious file inclusion attempts, and review file permissions to ensure wp-config.php and other sensitive files are not world-readable. Additionally, use security plugins to monitor for active exploitation and consider temporarily disabling the MetaMax theme if a patched version is unavailable and the site cannot be isolated from untrusted networks.