What is the CVSS score of CVE-2026-32504?

CVE-2026-32504 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-32504?

CVE-2026-32504 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-32504?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-32504

EUVD-2026-15857 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-3jh5-j4j5-8xqx

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15857

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS VintWood vintwood allows PHP Local File Inclusion.This issue affects VintWood: from n/a through <= 1.1.8.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in CreativeWS VintWood WordPress theme versions up to and including 1.1.8, stemming from improper control of filenames in PHP include/require statements. This vulnerability allows unauthenticated attackers to read arbitrary files from the affected server, potentially exposing sensitive configuration files, database credentials, and other confidential information. No CVSS score, EPSS data, or KEV status is currently available, but the issue is documented across multiple security intelligence sources including Patchstack and ENISA.

Technical ContextAI

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes improper validation of user-supplied input used in PHP's include(), require(), include_once(), or require_once() functions. The affected product is CreativeWS VintWood (CPE: cpe:2.3:a:creativews:vintwood:*:*:*:*:*:*:*:*), a WordPress theme that fails to adequately sanitize or validate file path parameters. This allows attackers to craft specially-formed requests that cause the PHP application to load and execute arbitrary local files on the server, leading to information disclosure. The underlying issue is a failure to implement proper input validation and path traversal protections before passing user-controlled data to file inclusion functions.

RemediationAI

Upgrade CreativeWS VintWood to a version higher than 1.1.8 immediately upon availability of a patched release. Check the Patchstack vulnerability database and CreativeWS official channels for the patched version number and installation instructions. Until a patch is available, implement access controls by disabling the affected theme functionality via WordPress plugin firewalls (e.g., Wordfence, Sucuri), restrict direct web access to the theme directory using web server rules (.htaccess or nginx configuration), and consider temporarily switching to an alternative WordPress theme if no patch is forthcoming. Additionally, audit server logs for evidence of exploitation attempts and review file access logs for any unauthorized file reads. Ensure WordPress core, all plugins, and all themes are kept up to date to minimize the attack surface.