CVE-2026-32503: 
WordPress vulnerability analysis and mitigation

CVE-2026-32503 is a Local File Inclusion (LFI) vulnerability in the CreativeWS Trendustry WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Trendustry theme up to and including version 1.1.4, and was reported by researcher Phat RiO on January 20, 2026, with public disclosure on March 20–25, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication (Patchstack, Feedly).

The root cause is improper control of filename parameters used in PHP include/require statements within the Trendustry theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server's filesystem. The attack vector is network-based, requires no authentication or user interaction, but is rated as high complexity, suggesting some precondition or non-trivial exploitation step is involved. An unauthenticated remote attacker can craft a malicious HTTP request with a manipulated file path parameter to trigger the inclusion of sensitive local files. The vulnerability was discovered and reported by security researcher Phat RiO and assigned by Patchstack (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially enabling complete database takeover. The vulnerability has high impact on confidentiality, integrity, and availability, as file inclusion can also lead to code execution if an attacker can control or inject content into an included file. Depending on server configuration, this could facilitate lateral movement within the hosting environment or full site compromise (Patchstack).

As of the time of disclosure, no public proof-of-concept exploit code has been published and no active in-the-wild exploitation has been confirmed. The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Trendustry theme (version ≤ 1.1.4) via tools like WPScan, Shodan, or by inspecting theme metadata in page source (/wp-content/themes/trendustry/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP code or publicly available source to locate the file inclusion point where user-supplied input is passed to a PHP include/require statement without adequate sanitization.
3. Craft malicious request: Send an HTTP request (GET or POST) to the vulnerable endpoint with a manipulated file path parameter, such as a path traversal sequence (e.g., ../../../../wp-config.php) targeting sensitive files.
4. Extract sensitive data: Review the server's response for the contents of the included file (e.g., database credentials from wp-config.php, system files like /etc/passwd).
5. Escalate access: Use extracted credentials or session tokens to gain further access to the WordPress admin panel, database, or hosting environment (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body; requests targeting known sensitive files such as wp-config.php or /etc/passwd.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal patterns to Trendustry theme URLs; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php; presence of web shells or unfamiliar PHP files in the theme directory (/wp-content/themes/trendustry/).
• Process: Unusual PHP processes spawning child processes or making outbound network connections from the web server.

The primary remediation is to update the Trendustry theme to version 1.1.5 or later, which contains the patch for this vulnerability (Patchstack). If an immediate update is not possible, site owners should implement a Web Application Firewall (WAF) — Patchstack has issued a virtual patch/mitigation rule to block exploitation attempts. Additional hardening steps include setting allow_url_include = Off in php.ini, implementing strict input validation on all file path parameters, and restricting PHP file read permissions where possible.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of March 16–22, 2026, highlighting it as part of broader WordPress ecosystem security coverage (Wordfence). Patchstack, the assigning CNA, classified it as high priority and noted that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites regardless of their traffic or popularity (Patchstack).