CVE-2026-32369: Medilink-Core Path Traversal Vulnerability

CVE-2026-32369 Overview

CVE-2026-32369 is a Local File Inclusion (LFI) vulnerability in the RadiusTheme Medilink-Core WordPress plugin. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing authenticated attackers to include arbitrary local files on the server. This type of vulnerability (CWE-98) can potentially lead to sensitive information disclosure, remote code execution through log poisoning or other techniques, and full server compromise.

Critical Impact

Authenticated attackers with low privileges can exploit this LFI vulnerability to read sensitive server files, potentially escalating to remote code execution through inclusion of malicious content in accessible files such as logs or uploaded data.

Affected Products

• RadiusTheme Medilink-Core WordPress Plugin versions prior to 2.0.7

Discovery Timeline

• 2026-03-13 - CVE CVE-2026-32369 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32369

Vulnerability Analysis

This vulnerability exists due to insufficient input validation and sanitization of user-controlled parameters that are subsequently used in PHP include or require statements within the Medilink-Core plugin. The attack requires network access and authenticated privileges, though exploitation complexity is considered high. When successfully exploited, attackers can achieve high impact across confidentiality, integrity, and availability of the affected system.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can be chained with other techniques to achieve remote code execution. Common exploitation paths include reading sensitive configuration files like wp-config.php, accessing server logs containing injected PHP code, or including uploaded files with malicious payloads.

Root Cause

The root cause of CVE-2026-32369 is improper control of filename parameters in PHP include/require statements (CWE-98). The Medilink-Core plugin fails to adequately validate and sanitize user input before using it to construct file paths for PHP's include or require functions. This allows attackers to manipulate the file path using directory traversal sequences or other techniques to include files outside the intended directory scope.

Attack Vector

The attack vector for this vulnerability is network-based, requiring authenticated access to the WordPress installation. An attacker with at least subscriber-level privileges could potentially craft malicious requests that manipulate file path parameters passed to vulnerable include/require statements within the plugin.

The exploitation involves submitting specially crafted input containing directory traversal sequences (such as ../) or absolute file paths to target sensitive files on the server. Successful exploitation could allow reading of configuration files, inclusion of server logs containing injected code, or access to other sensitive system files accessible to the web server process.

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2026-32369

Indicators of Compromise

• Web server access logs containing requests with directory traversal patterns (../, ..%2f, ..%5c) targeting Medilink-Core plugin endpoints
• Unusual file access patterns in web application logs, particularly attempts to access /etc/passwd, wp-config.php, or log files
• Requests containing null byte injection attempts (%00) combined with file path parameters
• Unexpected PHP errors or warnings related to file inclusion operations in error logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block directory traversal patterns in request parameters
• Monitor for anomalous requests to the Medilink-Core plugin directory with suspicious file path parameters
• Deploy file integrity monitoring on sensitive configuration files to detect unauthorized access attempts
• Configure intrusion detection systems to alert on patterns consistent with LFI exploitation

Monitoring Recommendations

• Enable detailed access logging for the WordPress installation and review logs for suspicious patterns
• Set up alerts for requests containing common LFI payloads targeting the /wp-content/plugins/medilink-core/ directory
• Monitor server-side PHP error logs for file inclusion failures that may indicate exploitation attempts
• Implement behavioral analysis to detect unusual file access patterns from the web server process

How to Mitigate CVE-2026-32369

Immediate Actions Required

• Update the RadiusTheme Medilink-Core plugin to version 2.0.7 or later immediately
• Audit access logs for any evidence of prior exploitation attempts
• Review WordPress user accounts and remove any unauthorized or suspicious accounts
• Temporarily disable the Medilink-Core plugin if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Medilink-Core version 2.0.7. Site administrators should update to this version or later through the WordPress plugin management interface or by downloading the latest version from the official source. For more details, consult the Patchstack Vulnerability Advisory.

Workarounds

• Implement strict Web Application Firewall rules to block directory traversal patterns in all request parameters
• Restrict plugin functionality to only trusted administrative users until the patch can be applied
• Apply the principle of least privilege to WordPress user accounts, limiting authenticated access where possible
• Consider using PHP configuration directives like open_basedir to restrict file system access for the web server

# Example Apache mod_rewrite rules to block common LFI patterns
# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\.%2f|\.\.%5c) [NC]
RewriteRule .* - [F,L]