Security readout for executives and security teams
Plain-English summary
CVE-2026-32505 is a high-severity local file inclusion issue in the CreativeWS Kiddy WordPress theme affecting versions through 2.0.8. A vulnerable site may allow an unauthenticated remote attacker to influence PHP include/require behavior and access or impact sensitive files, but the bundle does not provide exploit details or evidence of active exploitation.
Executive priority
High priority for any organization running WordPress with the Kiddy theme. Internet-facing confirmed deployments at version 2.0.8 or earlier should be triaged urgently, with removal or vendor-confirmed remediation prioritized ahead of routine maintenance.
Technical view
The vulnerability is mapped to CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The CVE description states that CreativeWS Kiddy allows PHP local file inclusion and affects Kiddy through version 2.0.8. CVSS 3.1 score is 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network reachability, no required privileges or user interaction, high attack complexity, unchanged scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Internet-facing WordPress sites with the CreativeWS Kiddy theme installed at version 2.0.8 or earlier are the primary exposure. The bundle does not identify affected CPEs, specific vulnerable files, or whether inactive installed copies are exploitable, so exposure should be confirmed against each WordPress installation and vendor guidance.
Exploitation context
The source bundle marks KEV as false and provides no source-supported evidence of active exploitation. No exploit code, payload, vulnerable endpoint, or public exploitation status is included in the provided sources. Treat as high priority due to unauthenticated network attack surface and high CIA impact, while avoiding claims of in-the-wild exploitation.
Researcher notes
Patch evidence and a fixed version are not present in the provided bundle. The CVE text describes both PHP Remote File Inclusion terminology and local file inclusion impact; report this conservatively as local file inclusion because that is the stated vulnerability title and description outcome. KEV is false, so active exploitation should not be asserted from this bundle.
Mitigation direction
- Inventory WordPress properties for the CreativeWS Kiddy theme and record installed versions.
- For any instance running Kiddy version 2.0.8 or earlier, remove or disable the theme if it is not required.
- If the theme is required, check CreativeWS, WordPress theme distribution channels, and Patchstack guidance for an official fixed version or vendor-recommended mitigation before assuming an update exists.
- Apply an official fixed release when vendor evidence is available, then remove any obsolete vulnerable copies left on disk if vendor guidance recommends doing so.
- Review WordPress and web server logs for suspicious file inclusion activity, without attempting to reproduce exploit payloads.
- Use compensating controls such as hardened file permissions, least-privilege PHP execution context, and web application firewall rules where available, but do not rely on these as a substitute for vendor remediation.
Validation and detection
- Confirm whether each WordPress site has the Kiddy theme installed and whether the version is 2.0.8 or earlier.
- Confirm vulnerable versions have been disabled, removed, or upgraded according to vendor or Patchstack guidance.
- Verify the active theme after mitigation so production sites are not still rendering through Kiddy <= 2.0.8.
- Check that backups, staging sites, and unused theme directories do not retain exposed vulnerable copies.
- Review security monitoring for attempted include/require manipulation patterns and unexpected file access around the publication and update dates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-98: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-32505 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.