A vulnerability was found in themelexus Medilazar Core Plugin up to 1.4.7 on WordPress. It has been classified as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes improper control of filename for include/require statement in php program (‘php remote file inclusion’).
This vulnerability is registered as CVE-2026-32426. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
