Skip to main content

Wpcafe CVE-2024-37513

HIGH
Path Traversal (CWE-22)
2024-07-09 audit@patchstack.com
Path Traversal Wpcafe Themewinter
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 09, 2024 - 13:15 nvd
HIGH 8.8

DescriptionNVD

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.

AnalysisAI

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.2.27. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.2.27. Affected products include: Themewinter Wpcafe. Version information: through 2.2.27..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Wpcafe

View all
CVE-2026-86812 MEDIUM POC
6.5 Sep 11

Unauthenticated order-management access in WPCafe WordPress plugin before 3.0.18 stems from REST API permission callback
CVE-2026-66587 CRITICAL
9.8 Aug 24

Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated a
CVE-2026-14550 MEDIUM POC
5.3 Aug 26

Unauthorized reservation creation in the WPCafe WordPress plugin (all versions before 3.0.18) exposes the administrator

CVE-2026-27071 CRITICAL
9.1 Mar 25

A missing authorization vulnerability exists in Arraytics WPCafe WordPress plugin versions up to 3.0.7, where incorrectl
CVE-2024-5431 HIGH
8.8 Jun 25

The WPCafe - Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is v
CVE-2024-43135 HIGH
8.8 Aug 13

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allow
CVE-2026-66585 HIGH
7.5 Aug 24

Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attac
CVE-2024-5427 MEDIUM
6.4 May 31

The WPCafe - Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is v
CVE-2023-47805 MEDIUM
5.3 Dec 09

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control

CVE-2024-1855 MEDIUM
5.3 May 23

The WPCafe - Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPr

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2024-37513 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy