CVE-2026-32426 Overview
CVE-2026-32426 is a PHP Local File Inclusion (LFI) vulnerability in the themelexus Medilazar Core WordPress plugin. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Affected versions include all releases of Medilazar Core up to and including 1.4.7. An authenticated attacker with low privileges can manipulate file path parameters to load arbitrary local PHP files. Successful exploitation enables sensitive information disclosure, server-side code execution through inclusion of attacker-controlled files, and full compromise of the WordPress installation.
Critical Impact
Authenticated attackers can include arbitrary local files through the Medilazar Core plugin, leading to code execution and complete compromise of the underlying WordPress host.
Affected Products
- themelexus Medilazar Core plugin for WordPress
- All Medilazar Core versions from initial release through 1.4.7
- WordPress sites using the Medilazar medical/pharmacy theme bundle
Discovery Timeline
- 2026-03-13 - CVE-2026-32426 published to NVD
- 2026-04-22 - Last updated in NVD database
Technical Details for CVE-2026-32426
Vulnerability Analysis
The Medilazar Core plugin contains a PHP file inclusion weakness classified under [CWE-98]. User-controllable input is passed into a PHP include or require statement without sufficient validation against a fixed allowlist. This allows an attacker to traverse the filesystem and load arbitrary PHP files accessible to the web server process.
Local File Inclusion converts into code execution when an attacker can write controlled content to any included path. Common amplification techniques include log poisoning, session file inclusion, and uploading content through plugin-permitted media endpoints. The attack requires low privileges and no user interaction, but exploitation complexity is rated high due to environmental preconditions.
Root Cause
The root cause is missing or insufficient sanitization of a filename or path parameter consumed by a dynamic PHP inclusion function. The plugin does not normalize the path, reject directory traversal sequences such as ../, or restrict inclusion to a predefined set of template files. Refer to the Patchstack Plugin Vulnerability Report for advisory details.
Attack Vector
The vulnerability is exploited over the network through HTTP requests to the vulnerable plugin endpoint. An authenticated low-privileged user submits a crafted parameter referencing a target file path on the server. The PHP interpreter executes the included file in the context of the WordPress process. No verified public proof-of-concept code is available at the time of this writing.
Detection Methods for CVE-2026-32426
Indicators of Compromise
- HTTP requests to Medilazar Core plugin endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths to system files like /etc/passwd or wp-config.php.
- Unexpected PHP errors in web server logs referencing include() or require() calls with unusual file paths.
- Outbound connections or shell commands originating from the www-data or PHP-FPM process after plugin endpoint access.
Detection Strategies
- Inspect WordPress access logs for parameter values containing filesystem paths, encoded traversal sequences, or references to sensitive files.
- Deploy web application firewall rules that block path traversal patterns against plugin URLs under /wp-content/plugins/medilazar-core/.
- Correlate authenticated WordPress sessions with anomalous plugin endpoint usage and subsequent file read events.
Monitoring Recommendations
- Enable PHP open_basedir logging and alert on inclusion attempts outside the WordPress document root.
- Monitor file integrity of wp-config.php, plugin directories, and uploads for unauthorized modifications.
- Track creation of new administrator accounts or scheduled tasks following plugin endpoint requests.
How to Mitigate CVE-2026-32426
Immediate Actions Required
- Update the Medilazar Core plugin to a version later than 1.4.7 once the vendor publishes a fixed release.
- Audit WordPress user accounts and revoke unnecessary contributor, author, or subscriber privileges to reduce the authenticated attack surface.
- Review web server and PHP error logs for prior exploitation attempts against the plugin.
Patch Information
At the time of publication, the Patchstack advisory lists all versions through 1.4.7 as vulnerable. Administrators should consult the Patchstack Plugin Vulnerability Report and the themelexus vendor changelog for the patched release version.
Workarounds
- Deactivate and remove the Medilazar Core plugin until a patched version is installed.
- Apply virtual patching at the WAF layer to block traversal sequences and absolute file paths on plugin URLs.
- Restrict PHP execution using open_basedir and disable_functions to limit the impact of arbitrary inclusion.
# Example php.ini hardening to constrain file inclusion
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
