CVE-2026-32393: Greenly Theme Addons File Inclusion Flaw

CVE-2026-32393 Overview

CVE-2026-32393 is a Local File Inclusion (LFI) vulnerability in the Greenly Theme Addons plugin for WordPress, developed by Creatives_Planet. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server's filesystem.

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes a common weakness where user-supplied input is used to construct file paths without proper sanitization, enabling attackers to manipulate the included file path.

Critical Impact

Authenticated attackers with low privileges can exploit this vulnerability to read sensitive configuration files, access credentials, and potentially achieve remote code execution through log poisoning or other chaining techniques.

Affected Products

• Greenly Theme Addons plugin versions prior to 8.2
• WordPress installations running vulnerable versions of the greenly-addons plugin

Discovery Timeline

• 2026-03-13 - CVE-2026-32393 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32393

Vulnerability Analysis

This Local File Inclusion vulnerability occurs when the Greenly Theme Addons plugin fails to properly validate and sanitize user-controlled input before using it in PHP include(), require(), include_once(), or require_once() statements. This allows an attacker to manipulate the file path parameter to include arbitrary files from the local server filesystem.

The vulnerability requires network access and low-level authentication to exploit, though successful exploitation can result in significant impact to confidentiality, integrity, and availability of the affected system. The attack complexity is high, which may limit widespread automated exploitation but doesn't diminish the risk for targeted attacks.

Root Cause

The root cause of CVE-2026-32393 lies in insufficient input validation within the Greenly Theme Addons plugin. When processing user-supplied parameters, the plugin directly incorporates these values into PHP file inclusion functions without properly:

• Validating that the requested file exists within an allowed directory
• Sanitizing path traversal sequences (e.g., ../)
• Implementing an allowlist of permitted files
• Restricting file extensions or paths

This design flaw allows attackers to escape the intended directory context and access files elsewhere on the server.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an authenticated user with at least low-level privileges (such as a subscriber or contributor role in WordPress) to exploit. An attacker can craft malicious requests that manipulate file path parameters to traverse directories and include sensitive local files.

Common exploitation scenarios include:

1. Reading sensitive configuration files - Including wp-config.php to extract database credentials
2. Accessing system files - Reading /etc/passwd or other system configuration files
3. Log file poisoning - Including log files that contain attacker-controlled content, potentially leading to remote code execution
4. Session file inclusion - Accessing PHP session files to hijack user sessions

The vulnerability can be exploited by modifying request parameters to include path traversal sequences that navigate to sensitive files outside the plugin's intended directory scope. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-32393

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences such as ../, ..%2f, or encoded variants targeting the Greenly Theme Addons plugin endpoints
• Web server logs showing attempts to access sensitive files like wp-config.php, /etc/passwd, or log files through plugin parameters
• Unexpected file access patterns in PHP or web server access logs originating from plugin-related URLs
• Evidence of configuration file disclosure or unauthorized access to system files

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests targeting WordPress plugin endpoints
• Monitor web server access logs for requests containing directory traversal sequences or attempts to access files outside normal web directories
• Deploy file integrity monitoring to detect unauthorized access or modifications to sensitive configuration files
• Utilize intrusion detection systems configured with signatures for LFI attack patterns

Monitoring Recommendations

• Enable verbose logging for WordPress and the greenly-addons plugin to capture detailed request information
• Set up automated alerting for suspicious file access patterns, particularly requests attempting to access files outside the plugin directory
• Regularly review access logs for anomalous requests containing encoded path traversal sequences
• Monitor for unusual file read operations on sensitive system and configuration files

How to Mitigate CVE-2026-32393

Immediate Actions Required

• Update the Greenly Theme Addons plugin to version 8.2 or later immediately
• Audit WordPress user accounts and remove unnecessary users with elevated privileges
• Review web server logs for any evidence of exploitation attempts prior to patching
• Consider temporarily disabling the Greenly Theme Addons plugin if immediate patching is not possible

Patch Information

The vulnerability affects Greenly Theme Addons versions prior to 8.2. Website administrators should update to version 8.2 or later to address this vulnerability. The patch information is available through the Patchstack Vulnerability Report.

To update the plugin:

1. Log in to your WordPress admin dashboard
2. Navigate to Plugins > Installed Plugins
3. Locate "Greenly Theme Addons" and click "Update Now"
4. Verify the plugin version is 8.2 or higher after the update

Workarounds

• If patching is not immediately possible, temporarily deactivate the Greenly Theme Addons plugin until an update can be applied
• Implement WAF rules to block requests containing path traversal sequences targeting the affected plugin
• Restrict file system permissions to limit the PHP process's ability to read sensitive files outside the web root
• Review and restrict WordPress user privileges to minimize the number of authenticated users who could potentially exploit this vulnerability

# Configuration example - WAF rule to block path traversal attempts
# Apache mod_security rule example
SecRule REQUEST_URI "@contains ../" "id:1001,phase:1,deny,status:403,msg:'Path traversal attempt blocked'"
SecRule REQUEST_URI "@contains ..%2f" "id:1002,phase:1,deny,status:403,msg:'Encoded path traversal attempt blocked'"

# Restrict file permissions on sensitive files
chmod 600 /var/www/html/wp-config.php
chown www-data:www-data /var/www/html/wp-config.php