The vulnerability CVE-2026-32392 in Creatives_Planet Greenly arises from improper validation of filenames used in PHP include or require statements. This allows remote attackers to perform Remote File Inclusion (RFI), enabling them to execute arbitrary code by including malicious files remotely. The vulnerability affects Greenly versions up to and including 8.1. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, low privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to compromise the affected system's confidentiality, integrity, and availability. This could result in unauthorized access, data theft, data manipulation, or service disruption. Given the high CVSS score and the nature of RFI vulnerabilities, the impact is considered high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to affected systems, disable remote file inclusion in PHP configurations if possible, and review application code to ensure proper validation of include/require statements. Monitor vendor channels for updates and apply patches promptly once available.