Description

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T15:17:07.530Z",
  "pubdate": "2026-08-18T15:17:07.530Z",
  "executiveSummary": "An unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the Restaurant Menu by MotoPress plugin, specifically affecting versions 2.4.11 and prior. This security flaw allows remote, unauthenticated attackers to exploit improper input validation within the plugin, leading to the inclusion and potential execution or disclosure of arbitrary files residing on the underlying server. The presence of this vulnerability poses severe risk implications, including potential source code disclosure, sensitive configuration file extraction, or remote code execution if combined with additional file upload vectors or log poisoning techniques. Attackers do not require any prior authentication or privileged access to interact with the vulnerable component, lowering the exploitation barrier significantly. The root cause stems from the insecure handling of user-supplied input passed directly into file inclusion functions without adequate sanitization or boundary enforcement. Immediate remediation is necessary to protect affected WordPress deployments from unauthorized file access and potential system compromise.",
  "technicalDetails": "The vulnerability is classified as a Local File Inclusion (LFI) flaw residing within the Restaurant Menu by MotoPress plugin for WordPress, impacting versions <= 2.4.11. The root cause of the vulnerability lies in the insecure implementation of file handling mechanisms where user-supplied parameters are passed directly to PHP file inclusion functions—such as include, require, include_once, or require_once—without undergoing rigorous sanitization, validation, or allow-listing.\nExploitation of this vulnerability requires no authentication or special privileges. An attacker interacting with the web application can craft malicious HTTP requests containing directory traversal sequences (such as ../) within the vulnerable parameter. When the application processes the input, it traverses the server directory structure outside the intended web root or application directory, allowing the inclusion of arbitrary local files accessible to the web server process user.\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable parameter exposed by the MotoPress Restaurant Menu component. Second, the attacker formulates a payload utilizing path traversal mechanics to target sensitive system files, such as /etc/passwd or application configuration files containing database credentials. Third, the HTTP request is sent to the target server, where the vulnerable component fails to validate the absolute or relative path constraints. Fourth, the server executes the file inclusion operation, reading the targeted local file and optionally reflecting its contents back within the HTTP response or executing embedded PHP code depending on the exact implementation context.\nNetwork exposure is absolute via the web application interface, as the vulnerable endpoint is accessible over HTTP/HTTPS without session validation. Post-exploitation impact ranges from information disclosure of sensitive operating system and application data to potential remote code execution via log poisoning or inclusion of files containing executable code writable by the web server daemon. Due to the lack of input sanitization and architectural reliance on user input for file system operations, the component remains critically susceptible until patches restricting input to hardcoded or strictly validated paths are applied."
}