{"id":"CVE-2026-75028","published":"2026-10-03T07:16:48.160","lastModified":"2026-10-06T15:04:52.637","description":"The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WPCafe WordPress plugin contains a Local File Inclusion vulnerability that allows authenticated users with contributor-level access or higher to include and execute arbitrary PHP files on the server. This can lead to full code execution and data compromise.","exploitability":"Exploitation requires an authenticated user with contributor privileges or higher, making it moderately difficult but achievable through social engineering or compromised accounts, with no additional preconditions beyond standard WordPress authentication.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to complete site compromise, data exfiltration, and further lateral movement within the hosting environment.","remediation":"Upgrade to version 3.0.19 or later to remediate the LFI vulnerability in the WPCafe plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["lfi","wordpress","rce","auth"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:58:47.593Z"}}