PHP CVE-2026-32426

Authenticated user account on Medilazar Core < 1.4.7 with access to functionality utilizing unvalidated filename parameters in include/require statements. Requires valid login credentials to reach vulnerable file inclusion code.

The CVSS 3.1 score of 7.5 (High) reflects significant potential impact with high confidentiality, integrity, and availability ratings, though tempered by high attack complexity and low privilege requirements. The attack vector is network-based but requires authenticated access (low privileges). The absence of this CVE from CISA's Known Exploited Vulnerabilities catalog and lack of EPSS data suggests no widespread exploitation in the wild yet. The high attack complexity (AC:H) indicates specific conditions must be met for successful exploitation, which reduces immediate risk compared to easily automated vulnerabilities. Without evidence of active exploitation or available proof-of-concept code, this represents a serious but not critical priority for most organizations.

An attacker with low-level WordPress credentials (such as a subscriber or contributor account) could craft malicious requests to vulnerable file inclusion points in the Medilazar Core plugin, potentially including PHP files from the local filesystem or remote servers. Due to the high attack complexity, the attacker would need detailed knowledge of the application structure and may need to chain multiple conditions, but successful exploitation could result in arbitrary code execution with web server privileges. No public proof-of-concept currently exists, which may limit immediate widespread exploitation attempts.