EUVD-2026-91955
GHSA-qq8p-42q8-m7f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor-level WordPress account
-
DeliveryStage malicious .php file on server
-
ExploitSupply crafted template parameter to food-menu shortcode
-
ExecutionPlugin includes attacker-controlled PHP file
-
ImpactExecute arbitrary PHP as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with contributor-level privileges or above (per CVSS PR:L) and targets the WPCafe food-menu rendering via the template scope/parameter in shortcodes and widgets (e.g., food-list.php, wpc-menus-list, wpc-location-menu). Local file read/inclusion works against affected installs, but achieving arbitrary PHP code execution additionally requires that the attacker can place a .php file on the server that the vulnerable function then includes - this upload-and-include precondition is the primary limiting factor and the reason for the AC:H rating. Limiting factors: no unauthenticated access (contributor account needed), high complexity due to the conditional PHP-upload requirement, and applicability only to sites running WPCafe versions up to and including 3.0.18. |
| Impact | This is a moderate-priority issue whose real-world risk is tempered by meaningful exploitation barriers. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) indicates network-reachable exploitation but with two important constraints: AC:H (high attack complexity) and PR:L (requires at least contributor-level authentication). The high-complexity rating aligns with the description, which notes that full code execution is only achievable 'in cases where .php file types can be uploaded and included' - i.e., the attacker must first stage a PHP payload on the server, which is a non-trivial, conditional step. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV, and no public exploit code is referenced - there is no public exploit identified at time of analysis. Signals are therefore internally consistent and point to a bounded threat: a credentialed-insider or compromised-low-privilege-account scenario rather than mass opportunistic exploitation. The requirement for contributor access significantly narrows the realistic attacker population. Note that no SSVC decision data or EPSS value was supplied, so the automatable/technical-impact dimensions of that framework cannot be evaluated from the input. |
| Exploit ScenarioDerived | An attacker who has obtained a contributor-level (or higher) WordPress account on a site running WPCafe ≤3.0.18 abuses the vulnerable template parameter in the food-menu shortcode/widget rendering path to make the plugin include an arbitrary local .php file. If the attacker can also upload a .php file (e.g., via a permissive media or upload path), the included file executes, yielding server-side PHP code execution; otherwise the primitive is usable to read sensitive local files and bypass access controls. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.
RemediationAI
No vendor-released patch version is identified in the available data, so the first step is to check the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve and the plugin's WordPress.org page for a release newer than 3.0.18 and upgrade to it as soon as one exists; if no fixed version is published, deactivate and remove the plugin from any site that does not strictly need it, accepting the loss of menu and ordering functionality. Where the plugin must stay active, reduce the attack surface by tightening the role model: revoke contributor and author accounts that are not strictly required, audit role assignments with a plugin such as a role editor, and treat any account able to create content with WPCafe shortcodes as a potential exploitation vector - this is a real operational cost on multi-author sites. Additionally, close the second half of the exploit chain by ensuring non-administrative roles cannot upload .php files (in WordPress this means restricting upload capability and blocking executable extensions, and verifying no separate upload plugin or theme editor grants that ability), since without a planted PHP file the issue is limited to local file disclosure. Deploy WAF or virtual-patching rules that inspect the shortcode/widget template scope parameters for path traversal sequences, encoded dots and slashes, and PHP stream wrappers, understanding that such rules are signature-based and may be bypassed by obfuscation. Finally, harden file permissions so the web server cannot read files outside the WordPress document root and disable PHP execution in the uploads directory to blunt any successful file-placement attempt.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause falls under CWE-98, improper control of filename for include/require statements in PHP, the classic PHP remote/local file inclusion class. WPCafe renders its food-menu output through shortcodes and widget templates that accept a caller-influenced template scope value and feed it into an include/require path without adequate canonicalization or an allow-list of permitted template files. The advisory references point at the exact sinks in plugin tags 3.0.17 and 3.0.18: core/shortcodes/views/food-menu/food-list.php (lines 6 and 53), core/shortcodes/views/food-menu/location-menu.php (line 28), and the widget renderers widgets/wpc-menus-list/wpc-menus-list.php (line 942), widgets/wpc-location-menu/wpc-location-menu.php (line 898), widgets/wpc-food-menu-tab/wpc-food-menu-tab.php (line 848) and widgets/wpc-food-location/wpc-food-location.php (line 830). Because the parameter resolves to a filesystem path rather than a remote URL, the immediate primitive is local file disclosure - WordPress configuration files, wp-config.php, credential-bearing files, or other readable PHP sources - and the escalation to arbitrary code execution depends on PHP being able to evaluate a file the attacker has managed to plant on disk, which is why the include-and-execute chain is gated by an upload precondition rather than being directly reachable. WordPress shortcodes and widgets are registered by the plugin and are typically reachable through normal post rendering and front-end widget output, so an account able to author content and invoke those shortcodes is sufficient to reach the vulnerable code path.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via web shortcode/widget (AV:N), but requires a contributor account (PR:L) and a conditional PHP-upload step for full RCE (AC:H); inclusion/execution yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Articles & Coverage 1
Executive ViewAI
The WPCafe restaurant menu, online ordering and table booking plugin for WordPress - present on every version through 3.0.18 - carries a high-severity file inclusion flaw that lets a low-privileged contributor-level account trick the server into reading or potentially executing files it should never expose. Because roughly every installation in use today is affected and the vendor has not released a fix, any site running this plugin with contributor or higher roles provisioned is exposed, and a successful attack could leak configuration files, credentials, or customer data and, under the right conditions, hand an attacker code execution on the web server. Leadership should care because the affected plugin is business-facing (menus, ordering, bookings), the exposure is fleet-wide rather than site-specific, and there is no vendor remedy to simply schedule.
No vendor-released patch identified at time of analysis (applies to all versions through 3.0.18). Interim mitigations: deactivate or remove the WPCafe plugin where feasible; strip contributor and higher privileges to the minimum set of trusted users and audit for stale accounts; deploy WAF/reverse-proxy rules blocking template-scope parameter manipulation and path-traversal or absolute-path include attempts; disable PHP remote and unexpected file inclusion and restrict include paths; enforce least-privilege filesystem write permissions on the web root and upload directories to prevent staging of a .php file required for code execution; enable file-integrity monitoring and log alerting for anomalous includes and new PHP files; prioritize upgrade to the first vendor-fixed version as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB