CVE-2026-66587: WP Cafe Pro Path Traversal Vulnerability

CVE-2026-66587 Overview

CVE-2026-66587 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WP Cafe Pro WordPress plugin at versions prior to 3.0.15. The flaw is classified under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. An unauthenticated remote attacker can influence a file path used in a PHP include or require statement. Successful exploitation exposes sensitive server files and can lead to remote code execution when combined with writable upload paths or log poisoning techniques.

Critical Impact
Unauthenticated attackers can include arbitrary local files through a network request, exposing WordPress secrets in wp-config.php and potentially executing PHP code hosted on the server.

Affected Products

WP Cafe Pro plugin for WordPress, all versions before 3.0.15
WordPress sites running WP Cafe Pro with restaurant, menu, or reservation functionality
Hosting environments where the vulnerable plugin is active and reachable over the network

Discovery Timeline

2026-08-24 - CVE-2026-66587 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-66587

Vulnerability Analysis

The vulnerability resides in a WP Cafe Pro request handler that accepts user-controlled input and passes it to a PHP include, require, include_once, or require_once statement without adequate validation. Because the endpoint does not require authentication, any remote client can trigger file inclusion by supplying a crafted parameter. The attack executes over the network with low complexity, no privileges, and no user interaction. An attacker can retrieve the contents of PHP source files, WordPress configuration files, and other readable files on the web server. When the attacker can also place attacker-controlled content on disk (uploads, log files, session files), the LFI escalates to arbitrary PHP execution in the web server context.

Root Cause

The root cause is improper control of a filename used in a PHP include statement, mapped to [CWE-98]. The affected code path treats a request parameter as a trusted path fragment and concatenates it into an include call. There is no allowlist of permitted files, no canonicalization of the resolved path, and no restriction preventing traversal sequences such as ../ from escaping the plugin directory.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends an HTTP request to the vulnerable WP Cafe Pro endpoint and supplies a path parameter pointing to a target file such as wp-config.php or a poisoned log file. PHP resolves the path and includes the file, returning its contents in the response or executing embedded PHP code. No verified public proof-of-concept code is available at this time. Refer to the Patchstack advisory for WP Cafe Pro for advisory-level technical detail.

Detection Methods for CVE-2026-66587

Indicators of Compromise

HTTP requests to WP Cafe Pro endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes
Access log entries where a plugin parameter resolves to files outside wp-content/plugins/wpcafe-pro/
Unexpected reads of wp-config.php, /etc/passwd, or PHP session and log files by the web server user
New or modified PHP files in upload directories following suspicious inbound requests

Detection Strategies

Inspect web server access logs for query strings referencing sensitive filenames or traversal patterns targeting WP Cafe Pro AJAX or REST endpoints
Deploy a web application firewall rule that blocks path traversal payloads on plugin routes containing wpcafe or wp-cafe
Correlate anomalous file read syscalls from php-fpm or Apache workers with inbound HTTP requests to the plugin
Compare the installed plugin version against 3.0.15 across all managed WordPress sites

Monitoring Recommendations

Alert on outbound responses that contain WordPress database credentials or PHP source markers such as <?php from plugin endpoints
Monitor file integrity for the wp-content/uploads/ and plugin directories to catch webshell drops
Track new administrator accounts and cron entries created after suspicious inclusion attempts

How to Mitigate CVE-2026-66587

Immediate Actions Required

Upgrade WP Cafe Pro to version 3.0.15 or later on every WordPress site where the plugin is installed
Audit access logs for exploitation attempts dating back to plugin installation and rotate any secrets exposed in wp-config.php
Temporarily deactivate WP Cafe Pro on sites that cannot be patched immediately
Review WordPress user accounts, scheduled tasks, and files under wp-content/uploads/ for unauthorized changes

Patch Information

The vendor addressed the vulnerability in WP Cafe Pro 3.0.15. Update through the WordPress plugin manager or by replacing the plugin files with the fixed release. Consult the Patchstack WP Cafe Pro advisory for the authoritative fix reference.

Workarounds

Block requests to WP Cafe Pro endpoints containing ../, ..%2f, or absolute paths at the WAF or reverse proxy layer
Set the PHP open_basedir directive to restrict file access to the WordPress document root and plugin directories
Disable PHP execution inside wp-content/uploads/ using web server configuration to blunt LFI-to-RCE escalation
Restrict access to WP Cafe Pro admin and AJAX endpoints by source IP where feasible

bash

# Example nginx configuration to block traversal payloads on the plugin path
location ~* /wp-content/plugins/wpcafe-pro/ {
    if ($args ~* "(\.\./|\.\.%2f|%00)") {
        return 403;
    }
}

# Prevent PHP execution in uploads to reduce LFI-to-RCE risk
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}