CVE-2026-32364: LFI in Turbo Manager WordPress Plugin

The impact of this LFI vulnerability is significant. An attacker with contributor access can leverage this flaw to execute arbitrary PHP code on the server. This could involve uploading a malicious PHP file disguised as an image, then including it through the vulnerable parameter. Successful exploitation allows attackers to bypass access controls, steal sensitive data stored on the server (database credentials, API keys, user data), and potentially gain complete control over the WordPress instance. The blast radius extends to any data accessible by the WordPress application, and the attacker could potentially pivot to other systems on the same network if the server is not properly segmented.

1. Reservado2026-03-12
2. Publicada2026-02-16
3. Modificada2026-05-05
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-32364 is to immediately upgrade the Turbo Manager plugin to version 4.0.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious file inclusion attempts. Specifically, look for patterns attempting to include files outside of the plugin's designated directories. Additionally, restrict file upload permissions to prevent attackers from uploading malicious PHP files. After upgrading, verify the fix by attempting to access a non-existent file through the vulnerable parameter; the server should return a 404 error instead of executing the file.