The Themelexus Medilazar Core plugin is affected by a Local File Inclusion vulnerability that could allow an authenticated attacker to compromise system files.

This vulnerability is a Local File Inclusion (CWE-98) occurring within the medilazar-core plugin. It requires an attacker to have low-level privileges to successfully manipulate include statements to access unauthorized files on the server.

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive server-side files, potentially resulting in full system compromise. Given the CVSS score of 7.5, this is considered a high-severity risk that could lead to data exfiltration and significant operational disruption if sensitive configuration or credentials are exposed.

Immediate Action: Organizations using the Medilazar Core plugin should verify if they are running version 1.4.7 or later and restrict access to the plugin settings to authorized users only.

Proactive Monitoring: Security teams should monitor web server access logs for unusual path traversal patterns or requests attempting to include non-standard files with extensions such as .php, .txt, or .conf.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion signatures and directory traversal attempts.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the nature of LFI vulnerabilities, administrators must treat this as a serious security concern. While a specific patch version is currently not verified beyond the "fixed in 1.4.7" indication, users should immediately verify their current plugin version and apply updates if available to eliminate the exposure.