This vulnerability (CVE-2026-32464) is an unauthenticated Local File Inclusion (LFI) in the Theme Test Drive plugin by Vladimir Prelovac, affecting versions up to 2.9.1. It stems from improper control of filenames used in PHP include or require statements (CWE-98). An attacker can exploit this to include arbitrary local files on the server, which can lead to remote code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. No patch or official fix has been published yet.

Successful exploitation allows unauthenticated attackers to include arbitrary local files on the server running the vulnerable plugin. This can lead to disclosure of sensitive information, remote code execution, and full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score (8.1) reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates and patches.