CVE-2026-32384
Published: 13 March 2026
Summary
CVE-2026-32384 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32384 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98). It affects the WpBookingly service-booking-manager WordPress plugin developed by magepeopleteam, impacting all versions from an unspecified initial release through 1.2.9. The vulnerability was published on 2026-03-13 and carries a CVSS v3.1 base score of 7.5 (High).
Exploitation is possible over the network (AV:N) by an attacker with low privileges (PR:L), though it requires high attack complexity (AC:H) and no user interaction (UI:N). The scope remains unchanged (S:U), allowing a successful attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), such as reading sensitive local files or potentially executing arbitrary code through included PHP files.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the WordPress WpBookingly plugin version 1.2.9: https://patchstack.com/database/Wordpress/Plugin/service-booking-manager/vulnerability/wordpress-wpbookingly-plugin-1-2-9-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this reference for recommended mitigations, such as updating the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11889
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vuln in public-facing WP plugin directly enables T1190 for initial access, T1005 for arbitrary local file reads, and T1059 for PHP-based code execution via controlled includes.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of flaws like CVE-2026-32384 in the WpBookingly plugin to prevent exploitation.
Mandates validation and sanitization of user inputs controlling PHP include/require statements, directly preventing local file inclusion via improper filename handling.
Provides vulnerability scanning to identify the Local File Inclusion flaw in the WpBookingly WordPress plugin, enabling proactive remediation.