CVE-2026-32500: 
WordPress vulnerability analysis and mitigation

CVE-2026-32500 is a PHP Local File Inclusion (LFI) vulnerability in the CreativeWS MetaMax WordPress theme, affecting all versions up to and including 1.1.4. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by researcher Phat RiO on January 20, 2026, and publicly disclosed by Patchstack on March 20, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The MetaMax theme fails to properly validate or sanitize user-supplied input used in PHP file inclusion operations, allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting some precondition or bypass technique is needed. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and was assigned Patchstack ID PSID967d340df003 (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and read arbitrary local files on the web server, potentially exposing sensitive data such as database credentials, configuration files, and application secrets. If the attacker can chain LFI with file upload or log poisoning techniques, remote code execution may be achievable, leading to complete compromise of the WordPress application. The vulnerability carries high confidentiality, integrity, and availability impacts, meaning attackers could exfiltrate data, modify content, and disrupt service availability (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.0015 (0.15%), indicating a low but non-zero probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the MetaMax theme version 1.1.4 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/metamax).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the file inclusion parameter that accepts unsanitized user input.
3. Craft LFI payload: Construct a malicious HTTP request targeting the vulnerable endpoint with a path traversal payload (e.g., ../../../../etc/passwd or ../../../../wp-config.php) in the file inclusion parameter.
4. Extract sensitive files: Send the crafted request to the target server and retrieve the contents of sensitive files such as /etc/passwd, WordPress wp-config.php (containing database credentials), or server configuration files.
5. Escalate (optional): If a writable directory is accessible (e.g., via file upload), poison a log file or upload a PHP file and include it via the LFI vector to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to MetaMax theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body.
• Logs: Web server access logs showing requests with encoded traversal strings targeting theme PHP files; repeated 200 responses to requests with file path parameters pointing to system files like /etc/passwd or wp-config.php.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme folder; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI chaining.

The patched version of the MetaMax theme is 1.1.5, which resolves the LFI vulnerability — site administrators should update immediately via the WordPress dashboard or by manually replacing the theme files. If an immediate update is not possible, implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences targeting theme endpoints; Patchstack has issued a virtual patch/mitigation rule for subscribers. Additionally, audit server-side PHP configuration to ensure allow_url_include is disabled and restrict file system permissions to limit the impact of any successful LFI attempt (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering March 16–22, 2026, highlighting it as part of broader WordPress ecosystem security monitoring. Patchstack, which coordinated the disclosure, classified it as high priority and issued a virtual mitigation rule for their platform users. No significant independent researcher commentary or broader media coverage has been identified beyond these standard vulnerability disclosure channels (Wordfence, Patchstack).