WP Cafe Pro CVE-2026-66586

Exploitation requires a valid WordPress user account with the Author role or higher on the targeted site - unauthenticated exploitation is not possible given the CVSS PR:H metric. High attack complexity (AC:H) further implies that specific conditions must be met, such as identifying the exact vulnerable parameter, specific plugin configuration, or a particular WordPress content type or post context. The vulnerability is limited to sites running WP Cafe Pro versions below 3.0.15; sites that have upgraded to 3.0.15 or later are not affected. Deployments where all Author-role accounts belong to fully trusted, organization-controlled users face negligible realistic risk even prior to patching.

The composite risk picture for this vulnerability is moderate-to-low in most environments. The CVSS 6.6 base score is primarily held down by PR:H (high-privilege Author account required) and AC:H (high attack complexity), despite the C:H/I:H/A:H impact triad. This means that even a mid-sized municipal IT team in inowroclaw running a WordPress-based cafe reservation site could effectively neutralize this threat by auditing Author-level accounts and applying the patch promptly. No CISA KEV listing exists, no public POC has been disclosed, and EPSS data was not included in the provided intelligence - these combined signals suggest this is not under active opportunistic exploitation. The primary risk scenario is insider threat or a compromised Author account on a multi-user WordPress site; single-administrator deployments are unlikely to have untrusted Authors and face negligible realistic exposure. The C:H/I:H/A:H impact metrics are plausible for LFI (config file disclosure, log poisoning to RCE) but represent the ceiling of impact rather than the baseline - defenders should assess whether their deployment has untrusted Author-role users before treating this as urgent.

An attacker with a legitimate or compromised WordPress Author account identifies a plugin feature - likely a template selection, shortcode parameter, or file-rendering endpoint - that accepts a user-controlled file path without sanitization. The attacker submits a crafted request referencing a sensitive server file such as wp-config.php or /etc/passwd, and the plugin's PHP include statement processes it, returning the file's contents to the attacker. No public POC has been disclosed, but the vulnerability class (PHP LFI via CWE-98) is well-understood and trivially exploitable once the specific parameter is identified.