The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

zetlyn/cve-nvd vulnerability cve CVE-2026-75028 known 2026-10-03

https://nvd.nist.gov/vuln/detail/CVE-2026-75028

Properties

cvss7.5
receipt
Source
NVD
Its words
7.5
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
productWPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
receipt
Source
NVD
Its words
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
statusReceived
receipt
Source
NVD
Its words
Received
Read by
field:cve.vulnStatus
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
vendorarraytics
receipt
Source
NVD
Its words
arraytics
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}

Text

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.