What is the CVSS score of CVE-2026-32505?

CVE-2026-32505 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-32505?

CVE-2026-32505 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-32505?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-32505

EUVD-2026-15859 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-h6jq-2xmv-3pm5

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15859

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS Kiddy kiddy allows PHP Local File Inclusion.This issue affects Kiddy: from n/a through <= 2.0.8.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the CreativeWS Kiddy WordPress theme through version 2.0.8, allowing attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. An attacker can exploit this vulnerability to disclose sensitive information such as configuration files, database credentials, or other locally stored data without requiring authentication or special privileges. While no CVSS score or EPSS data is currently available, the vulnerability is actively tracked by multiple security intelligence sources including Patchstack and ENISA, indicating confirmed exploitability.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of weaknesses where user-controlled input is passed unsanitized to PHP's include() or require() functions. The CreativeWS Kiddy theme (CPE: cpe:2.3:a:creativews:kiddy:*:*:*:*:*:*:*:*) fails to properly validate or sanitize filename parameters, allowing attackers to traverse directory structures using path traversal sequences (e.g., '../../../etc/passwd') or to include remote resources, depending on server configuration. This is distinct from Remote File Inclusion (RFI) in that it leverages local filesystem access, though the vulnerability description mentions both LFI and RFI capabilities. The issue affects the WordPress theme ecosystem, meaning it directly impacts websites using this theme without adequate file access restrictions.

RemediationAI

Upgrade the CreativeWS Kiddy theme to a version newer than 2.0.8 immediately, as a patched version is presumed available. Consult the official Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/kiddy/vulnerability/wordpress-kiddy-theme-2-0-8-local-file-inclusion-vulnerability for patched release details and download links. If an immediate upgrade is not possible, implement server-level protections by restricting PHP's include_path directive to exclude user-writable directories, disabling remote file inclusion via php.ini settings (allow_url_include = Off), and applying strict file access controls via the Web Application Firewall (WAF) to block requests containing path traversal patterns such as '../' or encoded equivalents. Additionally, audit access logs for exploitation attempts and consider blocking direct access to theme files from external sources.