The vulnerability exists due to improper validation of file names in the include/require statements within the RadiusTheme Medilink‑Core plugin. It enables an attacker to force the plugin to include an arbitrary local file on the server, potentially leaking sensitive data or configuration files. The flaw is classified as CWE‑98 and could allow attackers to read any accessible files, which may lead to further compromise if the disclosed files contain credentials or other secrets.

Affected product is the Medilink‑Core plugin for WordPress by RadiusTheme. The vulnerability applies to all released versions from the initial release up through any version prior to 2.0.7. No specific sub‑release information is provided beyond the < 2.0.7 boundary.

The CVSS score of 7.5 denotes high severity, indicating significant potential impact if exploited. The EPSS score is below 1 %, pointing to a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web based, where a user can supply a malicious parameter in a request that is not sanitized before inclusion. Exploitation requires only local file inclusion and does not require elevated privileges, making it accessible to attackers with network reach to the WordPress site.