CVE-2026-32364
Local File Inclusion in Turbo Manager < 4.0.8 Allows Code Execution
Publication date: 2026-03-13
Last updated on: 2026-03-17
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redqteam | turbo_manager | to 4.0.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32364 is a Local File Inclusion (LFI) vulnerability found in the WordPress Turbo Manager Plugin versions prior to 4.0.8.
This vulnerability allows a malicious user with at least contributor or developer privileges to include and display local files from the target website.
These local files may contain sensitive information such as database credentials.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'Exploitation of this vulnerability can lead to exposure of sensitive files on the server.'}, {'type': 'paragraph', 'content': "If sensitive information like database credentials is disclosed, it could potentially lead to a complete database takeover depending on the website's configuration."}, {'type': 'paragraph', 'content': 'This can result in unauthorized access, data theft, or further compromise of the affected system.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability allows a malicious actor with contributor or developer privileges to include and display local files from the target website. Detection involves monitoring for unusual file inclusion attempts or suspicious requests targeting the Turbo Manager plugin.
Specific commands or detection methods are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should update the Turbo Manager plugin to version 4.0.8 or later, where the issue has been patched.
Additionally, using automated update tools provided by Patchstack can help rapidly protect vulnerable plugins.