MotoPress Restaurant Menu EUVD-2026-60806

The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required. The AC:H metric indicates exploitation is not straightforward and requires specific preconditions: the attacker must identify the precise vulnerable parameter within the plugin's request handling and construct a valid path traversal sequence that bypasses whatever partial filtering exists. Exploitation applies exclusively to WordPress installations running the Restaurant Menu by MotoPress plugin at version 2.4.11 or earlier - sites not running this plugin are unaffected. Factors that limit practical exploitation include: server-side PHP open_basedir restrictions (which would contain traversal to the web root), WordPress installations with non-standard or non-predictable directory structures, and the absence of readable log files (which blocks log-poisoning escalation). No special non-default configuration mode is documented as required - the vulnerability appears to exist in standard plugin deployments.

The CVSS score of 8.1 reflects genuinely high severity: the attack is network-reachable, requires no authentication, and carries full confidentiality, integrity, and availability impact. The AC:H rating is the primary moderating signal - exploitation is not a fire-and-forget condition and likely demands specific knowledge of the vulnerable parameter, valid path traversal sequences, and possibly a particular server configuration (e.g., log file location, open_basedir absence). No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified empirically; the absence of a KEV listing further suggests no confirmed widespread active exploitation at this time. However, even a mid-sized municipal IT team in radom operating a WordPress-based food-ordering platform should treat this as urgent, because successful exploitation of wp-config.php disclosure cascades directly into full database compromise without requiring further privilege escalation. The combination of zero authentication requirement and high CIA impact means that even a low rate of successful exploitation carries severe consequences per incident.

An unauthenticated attacker identifies a WordPress site running MotoPress Restaurant Menu ≤ 2.4.11, then probes the plugin's front-end endpoints to locate a parameter that passes user input to a PHP file-inclusion function. The attacker submits a crafted request containing a path traversal payload (e.g., ../../wp-config.php) that bypasses insufficient input filtering; if successful, the server returns the contents of the configuration file, exposing database credentials. In an environment where web server error or access logs are readable by the PHP process, the attacker may escalate by injecting a PHP payload into a log entry and subsequently including the log file to achieve arbitrary code execution.