CVE-2026-75028
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all
CVSS
7.5
High
EPSS
0.7%
p53
KEV
—
Exploit Today
16
0-100
Published: Oct 3, 2026 · Last modified: Oct 6, 2026 · CWE-98
0.7%EPSS · 30 days0.7%
2026-10-032026-10-21
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942
- plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe
- www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1128329.8 CRI—
———Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.5hCVE-2026-1128208.1 HIG—
———Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/a through 1.4.1.5hCVE-2017-202897.5 HIG—
———Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.9hCVE-2016-201018.1 HIG32.9%
——10Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value passed to require() to execute remote PHP code or include local files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.2dCVE-2026-1134026.5 MED28.9%
——9ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.2dCVE-2026-1118296.5 MED23.8%
——7Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.3d