Skip to main content

MotoPress Restaurant Menu EUVDEUVD-2026-60806

| CVE-2026-73400 HIGH
PHP Remote File Inclusion (CWE-98)
2026-08-18 Patchstack GHSA-9h23-r9f4-r5w6
PHP Information Disclosure LFI Restaurant Menu By Motopress
8.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network-facing WordPress plugin with no auth required (PR:N), but AC:H reflects path traversal precision needed; C/I/A:H justified by wp-config.php exposure and log-poisoning code execution potential.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 18, 2026 - 14:54 vuln.today
CVE Published
Aug 18, 2026 - 14:00 cve.org
HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Identify WordPress site running MotoPress plugin
Delivery
Probe front-end endpoints for LFI parameter
Exploit
Craft path traversal payload (e.g., ../../wp-config.php)
Install
Submit unauthenticated HTTP request
C2
Receive sensitive file contents
Execute
Optionally poison server logs with PHP payload
Impact
Include poisoned log to achieve code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS score of 8.1 reflects genuinely high severity: the attack is network-reachable, requires no authentication, and carries full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker identifies a WordPress site running MotoPress Restaurant Menu ≤ 2.4.11, then probes the plugin's front-end endpoints to locate a parameter that passes user input to a PHP file-inclusion function. The attacker submits a crafted request containing a path traversal payload (e.g., ../../wp-config.php) that bypasses insufficient input filtering; if successful, the server returns the contents of the configuration file, exposing database credentials. …
Remediation Update the Restaurant Menu by MotoPress plugin to the version released after 2.4.11 as soon as it becomes available via the WordPress plugin repository or the vendor; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-11-local-file-inclusion-vulnerability for the confirmed patched version, which was not explicitly stated in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all WordPress deployments running MotoPress Restaurant Menu plugin version 2.4.11 or earlier using your asset inventory or WordPress security scanning tools, document affected systems, and immediately implement access controls by blocking the plugin directory via web application firewall rules targeting /wp-content/plugins/moto-restaurant-menu/ and restricting WordPress admin panel access to trusted IP ranges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2018-11138 CRITICAL POC
9.8 May 31

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

Same weakness CWE-98 – PHP Remote File Inclusion

View all
CVE-2023-3452 CRITICAL POC
9.8
CVE-2024-10571 CRITICAL POC
9.8
CVE-2012-10025 CRITICAL POC
10.0
CVE-2023-6989 CRITICAL POC
9.8
CVE-2024-3136 CRITICAL POC
9.8
CVE-2024-3806 CRITICAL
9.8
CVE-2023-5815 HIGH POC
8.1
CVE-2024-9193 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-60806 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy