Cyber Resilience

CVE-2026-32384

High

Published: 13 March 2026

Published
13 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32384 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-32384 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98). It affects the WpBookingly service-booking-manager WordPress plugin developed by magepeopleteam, impacting all versions from an unspecified initial release through 1.2.9. The vulnerability was published on 2026-03-13 and carries a CVSS v3.1 base score of 7.5 (High).

Exploitation is possible over the network (AV:N) by an attacker with low privileges (PR:L), though it requires high attack complexity (AC:H) and no user interaction (UI:N). The scope remains unchanged (S:U), allowing a successful attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), such as reading sensitive local files or potentially executing arbitrary code through included PHP files.

The Patchstack advisory provides details on this Local File Inclusion vulnerability in the WordPress WpBookingly plugin version 1.2.9: https://patchstack.com/database/Wordpress/Plugin/service-booking-manager/vulnerability/wordpress-wpbookingly-plugin-1-2-9-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this reference for recommended mitigations, such as updating the plugin.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

LFI vuln in public-facing WP plugin directly enables T1190 for initial access, T1005 for arbitrary local file reads, and T1059 for PHP-based code execution via controlled includes.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13790Shared CWE-98
CVE-2025-30846Shared CWE-98
CVE-2026-22389Shared CWE-98
CVE-2025-30829Shared CWE-98
CVE-2025-68537Shared CWE-98
CVE-2026-28079Shared CWE-98
CVE-2026-28061Shared CWE-98
CVE-2026-28048Shared CWE-98
CVE-2026-22516Shared CWE-98
CVE-2026-28120Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires timely identification, reporting, and patching of flaws like CVE-2026-32384 in the WpBookingly plugin to prevent exploitation.

prevent

Mandates validation and sanitization of user inputs controlling PHP include/require statements, directly preventing local file inclusion via improper filename handling.

detect

Provides vulnerability scanning to identify the Local File Inclusion flaw in the WpBookingly WordPress plugin, enabling proactive remediation.

References