CVE-2026-32400
Received Received - Intake
Local File Inclusion Vulnerability in Boldman PHP

Publication date: 2026-03-13

Last updated on: 2026-03-13

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through <= 7.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-13
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-13
EPSS Evaluated
2026-06-15
NVD
CVE-2026-32400
EUVD
EUVD-2026-11917
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
themetechmount boldman to 7.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-32400 is a Local File Inclusion (LFI) vulnerability found in the WordPress Boldman Theme versions up to and including 7.7.'}, {'type': 'paragraph', 'content': 'This vulnerability allows a malicious actor with at least Contributor or Developer privileges to include and display local files from the target website.'}, {'type': 'paragraph', 'content': "These files may contain sensitive information such as database credentials, which could potentially lead to a complete database takeover depending on the website's configuration."}, {'type': 'paragraph', 'content': 'The vulnerability is related to improper control of filename for include/require statements in PHP, classified under OWASP Top 10 category A3: Injection.'}] [1]

Impact Analysis

This vulnerability can allow an attacker with certain privileges to access and display local files on your website.

If these files contain sensitive data such as database credentials, the attacker could potentially take over your entire database.

Such a compromise can lead to data breaches, loss of data integrity, and availability issues on your website.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The immediate step to mitigate this Local File Inclusion vulnerability in the WordPress Boldman Theme is to update the theme to version 7.8 or later, where the issue has been patched.

This update prevents malicious actors with Contributor or Developer privileges from including and displaying local files, which could contain sensitive information such as database credentials.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart