Description

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T12:16:52.837Z",
  "pubdate": "2026-08-24T12:16:52.837Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the WP Cafe Pro plugin, specifically affecting all versions prior to 3.0.15. This security flaw arises from improper input sanitization and validation within the affected software, allowing remote, unauthenticated threat actors to include arbitrary local files from the underlying server's filesystem.\nThe primary impact of this vulnerability includes potential sensitive data disclosure, such as system configuration files, source code, and credentials, depending on the permissions of the web server process. In certain configurations, chained vulnerabilities or log poisoning techniques could theoretically escalate this file inclusion vector into remote code execution (RCE).\nThe vulnerability affects WP Cafe Pro versions below 3.0.15 running on WordPress environments. The risk implications are critical due to the lack of authentication requirements, meaning any external attacker over the network can trigger the flaw without prior access credentials. Exploitation requires direct network access to the vulnerable WordPress installation and relies on the application improperly handling user-supplied parameters passed to file inclusion functions.\nOrganizations utilizing the affected product face significant security exposure until remediation steps are applied. Immediate patching is critical to neutralize the threat surface presented by this Local File Inclusion flaw.",
  "technicalDetails": "The vulnerability is classified as a Local File Inclusion (LFI) flaw residing within the WP Cafe Pro plugin for WordPress, impacting all versions strictly less than 3.0.15. The root cause of the vulnerability stems from inadequate sanitization, filtering, and validation of user-supplied input parameters that are subsequently passed directly into file handling or inclusion functions within the codebase of the vulnerable component.\nExploitation of this vulnerability is unauthenticated and does not require any prior privileges or interaction from a legitimate administrative user. A remote attacker can interact directly with the web application over the network by issuing specially crafted HTTP requests containing directory traversal sequences (such as dot-dot-slash patterns) or absolute file paths within the vulnerable parameter. Because the application fails to restrict file loading to a designated secure directory or whitelist, the underlying PHP process reads and processes the requested file from the local filesystem.\nThe step-by-step attack flow begins when an attacker identifies the vulnerable input vector within WP Cafe Pro. The attacker formulates an HTTP request appending traversal strings to target sensitive operating system or application files, such as /etc/passwd or database configuration files. The vulnerable component processes the request without sufficient validation, leading to the inclusion or display of the targeted file contents within the HTTP response or execution context. Depending on how the file inclusion is handled, this may result in direct information disclosure or the evaluation of included code blocks if the file contains executable scripts and the application logic permits.\nNetwork exposure is external, requiring only HTTP or HTTPS access to the targeted WordPress site. Privilege and authentication requirements are entirely absent, as the vulnerability is exploitable by unauthenticated visitors. Post-exploitation impact heavily correlates with the privileges of the web server user, potentially exposing sensitive environment variables, database credentials, and system configuration details that facilitate further network compromise."
}