What is the CVSS score of CVE-2026-32537?

CVE-2026-32537 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-32537?

CVE-2026-32537 presents notable security risk rated CVSS 7.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-32537?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-32537

EUVD-2026-15911 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-ppx9-7cj4-xjjh

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15911

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the nK Visual Portfolio, Photo Gallery & Post Grid WordPress plugin through version 3.5.1, allowing attackers to include and execute arbitrary local files on the server via improper control of filename parameters in PHP include/require statements. An attacker with network access can exploit this vulnerability to disclose sensitive information such as configuration files, database credentials, or other local files stored on the web server. While CVSS and EPSS scores are not publicly available, the vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require) and affects all installations of this plugin running version 3.5.1 or earlier.

Technical ContextAI

This vulnerability is a classic PHP Local File Inclusion (LFI) flaw rooted in CWE-98, which describes improper control of filenames passed to PHP include() or require() statements. The nK Visual Portfolio plugin (identified by CPE cpe:2.3:a:nk:visual_portfolio,_photo_gallery_&_post_grid:*:*:*:*:*:*:*:*) fails to properly sanitize user-supplied input before using it in file inclusion operations. Rather than implementing strict whitelisting or path canonicalization, the plugin directly incorporates attacker-controlled parameters into include/require directives. This allows attackers to traverse the filesystem using path traversal sequences (e.g., '../../../etc/passwd') or access wrapper protocols to read arbitrary files. The vulnerability affects the WordPress plugin ecosystem, which runs on PHP and is widely deployed across millions of websites.

RemediationAI

Immediately upgrade nK Visual Portfolio, Photo Gallery & Post Grid to a patched version beyond 3.5.1 (consult the vendor's official repository or security advisory for the latest stable release). If an immediate upgrade is not feasible, implement network-level controls by restricting web server access to trusted IP ranges only and disabling PHP file execution in directories where user uploads or plugin files are stored via .htaccess (php_flag engine off) or web server configuration. Additionally, enable PHP open_basedir directive to restrict file access to specific directories, implement strict input validation and output encoding throughout the plugin stack, and monitor log files for suspicious include/require patterns (e.g., attempts to access ../../../ paths). Contact the nK development team or monitor their official security advisory channels for patch availability and detailed remediation guidance.