CVE-2026-32560: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in LiquidThemes MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator

This vulnerability, identified as CWE-98, affects MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator versions up to 1.4. It involves improper control of the filename used in include or require statements, resulting in a local file inclusion (LFI) vulnerability. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can allow an attacker with low privileges to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The impact affects confidentiality, integrity, and availability of the affected WordPress plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin and server files, and monitor for updates from LiquidThemes regarding a patch.