The vulnerability CVE-2026-32369 affects RadiusTheme's Medilink-Core plugin before version 2.0.7. It involves improper control over filenames used in PHP include or require statements, resulting in a PHP Local File Inclusion vulnerability. This can allow an attacker to include local files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, low privileges required, high attack complexity, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include arbitrary local files, potentially leading to sensitive data disclosure, code execution, or denial of service. The vulnerability is exploitable remotely over the network with low privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor RadiusTheme's advisories for updates. Until a fix is available, consider restricting access to the vulnerable plugin and applying any available workarounds recommended by the vendor.