EUVD-2026-64806
GHSA-f9fq-34wr-7637
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to plugin endpoint
-
DeliveryInject path traversal into file parameter
-
ExploitTrigger PHP include/require of local file
-
ExecutionDisclose wp-config.php or sensitive files
-
ImpactHarvest DB credentials or pivot to RCE
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of WP Cafe Pro versions below 3.0.15, per CVSS AV:N/AC:L/PR:N/UI:N. The only prerequisite is that a site runs an affected WP Cafe Pro release with its vulnerable file-handling endpoint reachable over the network. The main limiting factors are the plugin's niche deployment (the target must actually run WP Cafe Pro < 3.0.15) and that escalation beyond file disclosure to code execution would additionally require an includable attacker-controlled file (e.g., via log poisoning or upload), which is not confirmed in the source data. |
| Impact | Signals are mixed between the raw score and the vulnerability class. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects a worst-case remote-code-execution outcome, but the description and Patchstack tags ('LFI', 'Information Disclosure') point primarily to unauthenticated file disclosure rather than confirmed RCE, so the I:H/A:H components may overstate real impact - my independent assessment lowers integrity/availability accordingly. No EPSS score, KEV entry, or POC was provided, so exploitation-probability data is missing: treat this as unauthenticated/network/low-complexity and therefore easy to exploit if a working request is derived, but with no evidence yet of active exploitation. The unauthenticated, no-interaction nature makes this a genuine patch priority for any site running the plugin, tempered by the plugin's relatively niche deployment footprint. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to the vulnerable WP Cafe Pro endpoint with a manipulated file-path parameter that traverses the filesystem, causing the plugin to read or include a local file such as wp-config.php and disclose database credentials. Because no authentication or user interaction is required, the request can be automated at scale; if the include path can be steered to attacker-controlled PHP, the same flaw may yield remote code execution. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade WP Cafe Pro to version 3.0.15 or later, which is the primary and authoritative fix per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpcafe-pro/vulnerability/wordpress-wp-cafe-pro-plugin-3-0-15-local-file-inclusion-vulnerability-2). Until the update can be applied, restrict access to the plugin's request endpoints with a WAF rule blocking path-traversal sequences (../, encoded variants, and absolute paths) on the plugin's parameters, and consider enabling a virtual-patching rule via Patchstack; note that aggressive WAF filtering can break legitimate menu/reservation requests, so tune and monitor. As a stronger stopgap, deactivate WP Cafe Pro if the reservation/ordering functionality is non-critical, accepting the loss of that feature until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Cafe Pro is a commercial WordPress plugin for restaurant/cafe reservations, food ordering, and menu management. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), the classic file-inclusion class in which user-influenced input reaches a PHP include/require or file-read routine without proper validation or path canonicalization. Because the affected CPE is cpe:2.3:a:wpcafe:wp_cafe_pro, exploitation runs within the WordPress PHP context, meaning a controllable path parameter can traverse the filesystem to load local files; if an includable path can be pointed at attacker-supplied PHP (e.g., via log poisoning or uploaded content), CWE-98 can escalate from disclosure to code execution.
Know when Wp Cafe Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network LFI with no interaction gives AV:N/AC:L/PR:N/UI:N and C:H for file disclosure; I:N/A:N because RCE escalation is unconfirmed, making this primarily a confidentiality impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
Articles & Coverage 1
Executive ViewAI
WP Cafe Pro WordPress plugin versions before 3.0.15 contain a critical vulnerability (CVE-2026-66587, CVSS 9.8) allowing unauthenticated attackers to read sensitive server files, including database credentials and configuration data, from any affected WordPress site over the network. Organizations using this plugin risk immediate exposure of database passwords and administrative credentials, leading to complete account and site compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Wp Cafe Pro
View allUnauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attac
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress A
Exploit-DB