CVE-2024-5431: Themewinter WPCafe RCE Vulnerability

CVE-2024-5431 Overview

The WPCafe plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 2.2.25. The flaw resides in the reservation_extra_field shortcode parameter, which fails to properly validate user-supplied input before including files. Authenticated attackers with Contributor-level access or above can exploit this issue to include arbitrary files on the server. Successful exploitation can lead to remote code execution, sensitive file disclosure, and full site compromise. The vulnerability is tracked under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Authenticated Contributor-level attackers can include arbitrary local or remote files through the vulnerable shortcode parameter, potentially achieving code execution on the WordPress host.

Affected Products

Themewinter WPCafe plugin for WordPress, versions ≤ 2.2.25
WordPress sites running WPCafe with WooCommerce integration
Any restaurant, cafe, or food-ordering site using the WPCafe reservation shortcode

Discovery Timeline

2024-06-25 - CVE-2024-5431 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5431

Vulnerability Analysis

The vulnerability is a PHP Local File Inclusion issue in the WPCafe reservation shortcode. The reservation_extra_field parameter is passed to a PHP include or require statement without sufficient sanitization or allowlisting. An authenticated user with Contributor privileges can embed the vulnerable shortcode inside a post or page and control the file path resolved by the include operation. Because WordPress renders shortcodes server-side, the include executes in the context of the web server process. Depending on server configuration, attackers may include local PHP files to trigger unintended code paths, disclose configuration secrets, or leverage log poisoning techniques to reach code execution.

Root Cause

The root cause is improper control of a filename supplied to a PHP file inclusion function within the reservation form template at core/shortcodes/views/reservation/reservation-form-template.php. The shortcode attribute reaches an include statement without normalization, directory restriction, or allowlist validation. This condition matches CWE-98.

Attack Vector

Exploitation requires an authenticated WordPress account with at least Contributor privileges. The attacker authors a post containing the WPCafe reservation shortcode and sets the reservation_extra_field parameter to a path that resolves to an attacker-controlled or sensitive file. When the post is rendered, the WPCafe template includes the referenced file. Attackers commonly abuse this pattern to include uploaded media, session files, or log files that contain injected PHP payloads. The vulnerability requires no user interaction beyond page rendering. See the WordPress Reservation Form Template source and the Wordfence Vulnerability Intelligence advisory for technical detail.

No verified public proof-of-concept code is available. The vulnerability mechanism is described above in prose.

Detection Methods for CVE-2024-5431

Indicators of Compromise

Posts or pages authored by Contributor-level accounts that contain WPCafe reservation shortcodes with unusual reservation_extra_field values.
Web server access logs showing shortcode-triggered rendering of posts followed by errors referencing unexpected file paths such as /etc/passwd, php://filter, or remote URLs.
Newly uploaded media files with PHP content or unusual extensions that coincide with reservation shortcode usage.
PHP error logs containing include() or require() warnings referencing paths derived from shortcode attributes.

Detection Strategies

Audit the WordPress wp_posts table for shortcode strings matching reservation_extra_field= and review the attribute values.
Monitor HTTP responses for signatures of file disclosure such as leaked configuration content or PHP source in rendered pages.
Alert on any Contributor or Author account authoring posts containing WPCafe reservation shortcodes with path-like values containing ../, ://, or absolute paths.

Monitoring Recommendations

Enable WordPress activity logging to capture post creation and edits by low-privilege accounts.
Forward Apache or Nginx access logs and PHP error logs to a centralized SIEM for correlation with authentication events.
Baseline the expected file access patterns of the wpcafe plugin and alert on deviations, particularly reads from outside the plugin directory.

How to Mitigate CVE-2024-5431

Immediate Actions Required

Update the WPCafe plugin to a version later than 2.2.25 as soon as the vendor publishes a fixed release.
Review all existing Contributor, Author, and higher-privileged accounts and remove or reset any that are unnecessary or inactive.
Inspect published and draft posts for suspicious WPCafe shortcodes and remove any containing path traversal or remote URL payloads.
Rotate WordPress secrets in wp-config.php if evidence of file disclosure is found.

Patch Information

Refer to the Wordfence advisory and the WPCafe plugin changelog for the fixed release. Apply updates through the WordPress plugin dashboard or via WP-CLI in staging before promoting to production.

Workarounds

Deactivate the WPCafe plugin until a patched version is installed if reservation functionality is not business-critical.
Restrict the unfiltered_html and shortcode-authoring capabilities of Contributor and Author roles using a role management plugin.
Configure the PHP runtime to disable remote file inclusion by setting allow_url_include=Off and allow_url_fopen=Off in php.ini.
Deploy a web application firewall rule to block requests containing reservation_extra_field attribute values that include ../, php://, or http(s)://.

bash

# Configuration example: harden PHP against remote and unsafe file inclusion
# /etc/php/8.x/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"

# Restart PHP-FPM to apply
sudo systemctl restart php8.2-fpm