CVE-2026-32500
Published: 25 March 2026
Summary
CVE-2026-32500 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the known PHP file inclusion flaw in the MetaMax WordPress theme through patching or upgrades.
Mandates validation of untrusted inputs to PHP include/require statements to block local file inclusion exploits.
Enforces secure configuration settings in PHP, such as open_basedir or disable_functions, to restrict arbitrary file access on the server.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The LFI vulnerability in a public-facing WordPress theme enables exploitation of public-facing applications (T1190), reading arbitrary local files for data collection (T1005, T1083), and accessing unsecured credentials in files like wp-config.php (T1552.001).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS MetaMax metamax allows PHP Local File Inclusion.This issue affects MetaMax: from n/a through <= 1.1.4.
Deeper analysisAI
CVE-2026-32500 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the CreativeWS MetaMax WordPress theme (metamax). This flaw impacts all versions from n/a through 1.1.4.
The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers without user interaction, though it requires high attack complexity. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to include and execute local files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/metamax/vulnerability/wordpress-metamax-theme-1-1-4-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability in the MetaMax WordPress theme version 1.1.4. Practitioners should consult this reference for specific patch or mitigation guidance, such as theme updates.
Details
- CWE(s)