The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

cve CVE-2026-75028 2 sources, 2 claims · Watch

NVD writes:
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. the claim

What it is to other things

In words only, so not counted until a person confirms one:

affectsarraytics/wpcafe_restaurant_menu_online_food_ordering_table_booking_system
NVD says “arraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System”
made_byarraytics
NVD says “arraytics”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
GitHub advisories7.5
receipt
Source
GitHub advisories
Its words
7.5
Read by
field:cvss.score
Said since
2026-10-03 12:05 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-75028",
  "cvss": {
    "score": 7.5,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.5,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-98",
      "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"
    }
  ],
  "description": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.",
  "ghsa_id": "GHSA-qq8p-42q8-m7f5",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qq8p-42q8-m7f5",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qq8p-42q8-m7f5"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-75028"
    }
  ],
  "nvd_published_at": "2026-10-03T07:16:48Z",
  "published_at": "2026-10-03T09:31:17Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-75028",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942",
    "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe",
    "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve",
    "https://github.com/advisories/GHSA-qq8p-42q8-m7f5"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T09:31:26Z",
  "url": "https://api.github.com/advisories/GHSA-qq8p-42q8-m7f5",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Cvss
cvss
NVD7.5
receipt
Source
NVD
Its words
7.5
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
—
Cwe
cwe
GitHub advisoriesCWE-98
receipt
Source
GitHub advisories
Its words
CWE-98
Read by
field:cwes[].cwe_id
Said since
2026-10-03 12:05 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-75028",
  "cvss": {
    "score": 7.5,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.5,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-98",
      "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"
    }
  ],
  "description": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.",
  "ghsa_id": "GHSA-qq8p-42q8-m7f5",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qq8p-42q8-m7f5",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qq8p-42q8-m7f5"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-75028"
    }
  ],
  "nvd_published_at": "2026-10-03T07:16:48Z",
  "published_at": "2026-10-03T09:31:17Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-75028",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942",
    "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe",
    "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve",
    "https://github.com/advisories/GHSA-qq8p-42q8-m7f5"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T09:31:26Z",
  "url": "https://api.github.com/advisories/GHSA-qq8p-42q8-m7f5",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Product
product
NVDWPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
receipt
Source
NVD
Its words
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Read by
field:cve.affected[].affectedData[].product
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
—
Severity
severity
GitHub advisorieshigh
From 7.0 to 8.9.
receipt
Source
GitHub advisories
Its words
high
Read by
field:severity
Said since
2026-10-03 12:05 UTC
Last answered
2026-10-04 18:15 UTC
Original
open at the source
What the source handed over
{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-75028",
  "cvss": {
    "score": 7.5,
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.5,
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-98",
      "name": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"
    }
  ],
  "description": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.",
  "ghsa_id": "GHSA-qq8p-42q8-m7f5",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-qq8p-42q8-m7f5",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-qq8p-42q8-m7f5"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-75028"
    }
  ],
  "nvd_published_at": "2026-10-03T07:16:48Z",
  "published_at": "2026-10-03T09:31:17Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-75028",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898",
    "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942",
    "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe",
    "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve",
    "https://github.com/advisories/GHSA-qq8p-42q8-m7f5"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is...",
  "type": "unreviewed",
  "updated_at": "2026-10-03T09:31:26Z",
  "url": "https://api.github.com/advisories/GHSA-qq8p-42q8-m7f5",
  "vulnerabilities": [],
  "withdrawn_at": null
}
—
Status
status
NVDReceived
receipt
Source
NVD
Its words
Received
Read by
field:cve.vulnStatus
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
—
Vendor
vendor
NVDarraytics
receipt
Source
NVD
Its words
arraytics
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-10-03 12:09 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System",
            "vendor": "arraytics",
            "versions": [
              {
                "lessThanOrEqual": "3.0.18",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@wordfence.com"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
      }
    ],
    "id": "CVE-2026-75028",
    "lastModified": "2026-10-03T07:16:48.160",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9,
          "source": "security@wordfence.com",
          "type": "Primary"
        }
      ]
    },
    "published": "2026-10-03T07:16:48.160",
    "references": [
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.17/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L53"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/food-list.php#L6"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/core/shortcodes/views/food-menu/location-menu.php#L28"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-location/wpc-food-location.php#L830"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-food-menu-tab/wpc-food-menu-tab.php#L848"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-location-menu/wpc-location-menu.php#L898"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.18/widgets/wpc-menus-list/wpc-menus-list.php#L942"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3706610%40wp-cafe&new=3706610%40wp-cafe"
      },
      {
        "source": "security@wordfence.com",
        "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31a1616d-a793-4153-bc19-551f39d699ec?source=cve"
      }
    ],
    "sourceIdentifier": "security@wordfence.com",
    "vulnStatus": "Received",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-98"
          }
        ],
        "source": "security@wordfence.com",
        "type": "Primary"
      }
    ]
  }
}
—

vulnerability

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
zetlyn/cve-nvd · 2026-10-03
cvss 7.5 product WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System status Received vendor arraytics source
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is...
zetlyn/cve-ghsa · 2026-10-03
cvss 7.5 cwe CWE-98 severity high source