Wp Cafe Pro
Monthly
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated sensitive data exposure in WP Cafe Pro WordPress plugin versions prior to 3.0.15 allows any remote attacker without credentials to retrieve sensitive information directly from affected WordPress installations. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw is network-exploitable with no authentication or user interaction required, yielding a CVSS 3.1 score of 7.5 (High). No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 3.0.15.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.