Home / Vulnerability Intelligence / CVE-2026-32531

CVE-2026-32531 - Vulnerability Analysis

HighCVSS: 8.1

Last Updated: March 25, 2026

Gavias Kunco - File Inclusion

Published: March 25, 2026Updated: March 25, 2026Remote Exploitable

Overview

Gavias Kunco < 1.4.5 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires crafted input.

Severity & Score

Severity: High

CVSS Score: 8.1

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can include local files, potentially leading to code execution or information disclosure.

Mitigation

Update to version 1.4.5 or latest available version.

References

https://patchstack.com/database/Wordpress/Theme/kunco/vulnerability/wordpress-kunco-theme-1-4-5-local-file-inclusion-vulnerability?_s_id=cve

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 25, 2026

🟠 CVE-2026-32531 - High (8.1) Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through < 1.4.5. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32531/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 25, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32531
Severity: High
CVSS Score: 8.1
Type: file_inclusion
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-98

CVSS Metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days