CVE-2026-73400 Overview
CVE-2026-73400 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Restaurant Menu by MotoPress WordPress plugin in versions up to and including 2.4.11. The flaw is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program). Remote attackers can trigger inclusion of local files on the server without authentication, potentially disclosing sensitive configuration data or enabling further code execution paths. The vulnerability is network-exploitable with no privileges or user interaction required.
Critical Impact
Unauthenticated attackers can include arbitrary local files through the vulnerable plugin, leading to sensitive information disclosure and potential remote code execution on affected WordPress sites.
Affected Products
- Restaurant Menu by MotoPress WordPress plugin (mp-restaurant-menu)
- Versions <= 2.4.11
- WordPress installations running the vulnerable plugin
Discovery Timeline
- 2026-08-18 - CVE-2026-73400 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-73400
Vulnerability Analysis
The vulnerability resides in the Restaurant Menu by MotoPress plugin, where a user-controlled input reaches a PHP include or require statement without adequate sanitization or allowlist validation. This class of flaw is classified as [CWE-98], Improper Control of Filename for Include/Require Statement. Because the endpoint does not require authentication, any remote client can supply a crafted path parameter to force the server to load an arbitrary file.
Successful exploitation can expose configuration files such as wp-config.php, credentials, and other sensitive server-side content. When combined with log poisoning, session file manipulation, or writable upload directories, LFI can escalate to remote code execution under the web server's privilege context.
The EPSS data available at publication indicates a low near-term exploitation probability, but the unauthenticated nature and high impact profile warrant prompt remediation.
Root Cause
The root cause is unsafe handling of a filename or path parameter that is passed directly into a PHP file inclusion function. The plugin fails to constrain the input to a fixed set of legitimate template files, allowing traversal sequences or absolute paths to reference files outside the intended directory.
Attack Vector
Exploitation occurs over the network against the WordPress site's HTTP interface. An attacker sends a crafted request to a vulnerable endpoint exposed by the mp-restaurant-menu plugin, supplying a path that resolves to an arbitrary file on the server. No authentication or user interaction is required. Refer to the Patchstack advisory for the Restaurant Menu by MotoPress plugin for endpoint specifics.
Detection Methods for CVE-2026-73400
Indicators of Compromise
- HTTP requests to mp-restaurant-menu plugin endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f.
- Requests with parameters referencing sensitive files including wp-config.php, /etc/passwd, or PHP session files.
- Web server access log entries showing repeated 200 responses to unusual plugin URLs from a single external source.
- Unexpected outbound traffic or new PHP files appearing in the WordPress uploads directory following suspicious inclusion attempts.
Detection Strategies
- Inspect web server and WordPress access logs for anomalous query parameters directed at /wp-content/plugins/mp-restaurant-menu/ endpoints.
- Deploy Web Application Firewall (WAF) rules that block path traversal patterns and known LFI payload signatures targeting WordPress plugins.
- Correlate authentication-less HTTP requests with subsequent reads of sensitive filesystem paths using endpoint telemetry.
Monitoring Recommendations
- Alert on any access to wp-config.php initiated by the web server process outside of expected application startup patterns.
- Monitor for creation of new PHP files or webshells in writable WordPress directories such as wp-content/uploads/.
- Track HTTP request volume and error rates against plugin endpoints to identify enumeration or brute-force inclusion attempts.
How to Mitigate CVE-2026-73400
Immediate Actions Required
- Update the Restaurant Menu by MotoPress plugin to a version above 2.4.11 as soon as the vendor releases a fixed release.
- If no patched version is available, disable and remove the mp-restaurant-menu plugin from affected WordPress installations.
- Rotate WordPress secrets, database credentials, and API keys stored in wp-config.php if exploitation is suspected.
- Review web server and application logs for prior exploitation attempts against the vulnerable endpoints.
Patch Information
Consult the Patchstack advisory for CVE-2026-73400 for current fix status and upgrade guidance. Administrators should subscribe to the plugin's changelog and apply security updates as soon as they become available.
Workarounds
- Deploy WAF rules that block requests containing directory traversal sequences targeting the plugin's endpoints.
- Restrict PHP open_basedir and disable allow_url_include in php.ini to limit the impact of arbitrary file inclusion.
- Apply least-privilege filesystem permissions so the web server user cannot read sensitive configuration files outside the WordPress webroot.
- Temporarily deactivate the plugin until a patched release is verified in a staging environment.
# Example php.ini hardening to limit LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
