Description

Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-20T12:16:32.800Z",
  "pubdate": "2026-08-20T12:16:32.800Z",
  "executiveSummary": "An Author-level Local File Inclusion vulnerability has been identified in WP Cafe Pro versions prior to 3.0.15. This security flaw enables authenticated users with author privileges to exploit improper input validation and file handling mechanisms within the affected plugin.\nThe primary impact of this vulnerability involves the potential inclusion and execution of arbitrary local files residing on the host server, which may lead to sensitive data exposure, configuration disclosure, or further system compromise depending on the server configuration and file permissions.\nThe affected product is WP Cafe Pro, specifically all deployments running versions below 3.0.15. Risk implications are significant as unauthorized file read operations bypass standard application logic controls.\nTo successfully execute an attack, the adversary requires authenticated access with an author-level role or higher within the WordPress environment. Exploitation requirements entail crafting malicious requests directed toward the vulnerable component to traverse directories and include arbitrary system files.",
  "technicalDetails": "The root cause of the Local File Inclusion vulnerability stems from insufficient sanitization, validation, and filtering of user-supplied input parameters passed into file inclusion or loading functions within WP Cafe Pro. When handling specific requests, the application fails to restrict file path resolution to designated safe directories, allowing path traversal sequences such as dot-dot-slash patterns.\nThe vulnerable component resides within the codebase of WP Cafe Pro affecting versions prior to 3.0.15. The flaw is exposed over the network via standard HTTP/HTTPS protocols utilized by the WordPress application layer. Authentication and privilege requirements dictate that the attacker must possess at least author-level privileges to interact with the vulnerable endpoint or functionality.\nThe attack flow proceeds as follows: First, the authenticated attacker authenticates to the WordPress dashboard with author privileges. Second, the attacker formulates a crafted HTTP request targeting the vulnerable parameter in WP Cafe Pro, embedding directory traversal sequences (e.g., ../../../) combined with a target file path pointing to sensitive system or application files. Third, the application processes the input without adequate validation, passing the manipulated path directly into the file inclusion routine. Fourth, the server reads the targeted local file and returns its contents within the HTTP response or processes the file execution depending on the inclusion context.\nPayload behavior involves traversing the file system hierarchy outside the web root to access system configuration files, source code, or internal logs. Post-exploitation impact includes the potential extraction of sensitive credentials, database connection strings, or environment variables, which can facilitate privilege escalation or complete system takeover."
}