CVE-2026-32364
Published: 13 March 2026
Summary
CVE-2026-32364 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32364 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the Turbo Manager WordPress plugin developed by redqteam. The issue affects all versions of Turbo Manager from n/a through those prior to 4.0.8. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98. The vulnerability was published on 2026-03-13.
Exploitation requires network access with high attack complexity and low privileges, such as an authenticated user with limited roles on the affected WordPress site, and no user interaction. Successful attackers can achieve high impacts on confidentiality, integrity, and availability, typically by tricking the plugin into including arbitrary local files, potentially leading to sensitive data exposure, server-side code execution, or system compromise depending on the included files and server configuration.
The Patchstack advisory for this vulnerability recommends updating to Turbo Manager version 4.0.8 or later, where the LFI issue is addressed. No additional mitigations are specified in the provided reference.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11856
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in redqteam Turbo Manager turbo-manager allows PHP Local File Inclusion.This issue affects Turbo Manager: from n/a through < 4.0.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin directly enables T1190 exploitation; arbitrary local file inclusion facilitates T1005 data access (e.g. configs) and T1505.003 web shell deployment or PHP code execution for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific LFI flaw in Turbo Manager plugin by requiring identification, reporting, and correction of the improper filename control prior to version 4.0.8.
Mandates validation of user-supplied filenames at web application interfaces to block malicious paths enabling PHP local file inclusion.
Enforces restrictions on filename inputs, such as blocking directory traversal sequences, to prevent exploitation of the improper include/require control.