The vulnerability CVE-2026-32384 affects the magepeopleteam WpBookingly WordPress plugin up to version 1.2.9. It arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an attacker with low privileges and no user interaction to read or execute files on the server, potentially leading to full compromise. The CVSS vector indicates network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, code execution, and full compromise of the affected web server hosting the WpBookingly plugin. The attacker can leverage the LFI to include arbitrary files, which may result in remote code execution or data leakage. Given the high CVSS score and impact metrics, this poses a serious security risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable WpBookingly plugin to mitigate risk. Monitor official channels from magepeopleteam for updates or patches addressing this vulnerability.