CVE-2026-32384
Published: 13 March 2026
Summary
CVE-2026-32384 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vuln in public-facing WP plugin directly enables T1190 for initial access, T1005 for arbitrary local file reads, and T1059 for PHP-based code execution via controlled includes.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.
Deeper analysisAI
CVE-2026-32384 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98). It affects the WpBookingly service-booking-manager WordPress plugin developed by magepeopleteam, impacting all versions from an unspecified initial release through 1.2.9. The vulnerability was published on 2026-03-13 and carries a CVSS v3.1 base score of 7.5 (High).
Exploitation is possible over the network (AV:N) by an attacker with low privileges (PR:L), though it requires high attack complexity (AC:H) and no user interaction (UI:N). The scope remains unchanged (S:U), allowing a successful attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), such as reading sensitive local files or potentially executing arbitrary code through included PHP files.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the WordPress WpBookingly plugin version 1.2.9: https://patchstack.com/database/Wordpress/Plugin/service-booking-manager/vulnerability/wordpress-wpbookingly-plugin-1-2-9-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this reference for recommended mitigations, such as updating the plugin.
Details
- CWE(s)