The vulnerability CVE-2026-32503 affects CreativeWS Trendustry versions up to 1.1.4 and is caused by improper control over the filename used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, which can allow an attacker to include unauthorized files on the server, potentially resulting in remote code execution or disclosure of sensitive information. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability can lead to high-impact consequences including full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files by including local files through the vulnerable PHP include/require mechanism. No known exploits in the wild have been documented so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as restricting file inclusion paths, disabling remote file inclusion in PHP configurations, or employing web application firewalls to detect and block malicious requests targeting this vulnerability.