The Medilazar Core plugin for WordPress contains an improper control of filename when using PHP's include/require statements, resulting in a local file inclusion (LFI) flaw. An attacker can supply a crafted file path that the plugin blindly includes, potentially revealing sensitive files or executing arbitrary PHP code if the attacker can provide a PHP file. This weakness corresponds to CWE-98 and threatens confidentiality, integrity, and availability of the affected WordPress site.

This vulnerability affects all releases of the Medilazar Core plugin from the first available version up to, but excluding, version 1.4.7. WordPress sites using any of these earlier versions of the plugin, regardless of theme or host, are potentially impacted. The affected product is the Medilazar Core plugin developed by themelexus.

The CVSS score of 7.5 marks it as high severity, while the EPSS score of less than 1% suggests a low current exploitation probability and it is not listed in the CISA KEV catalog. The likely attack vector is through an LFI that can be triggered by manipulating a user-supplied filename parameter or similar input. Security teams should treat this as a high‑risk vulnerability and prioritize patching or hardening measures.