CVE-2026-75028: WPCafe WordPress Plugin RCE Vulnerability

CVE-2026-75028 Overview

CVE-2026-75028 is a Local File Inclusion (LFI) vulnerability in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress. The flaw affects all versions up to and including 3.0.18 and resides in the plugin's template scope handling. Authenticated attackers with contributor-level access or higher can include and execute arbitrary .php files on the server. Successful exploitation enables access control bypass, disclosure of sensitive data, or code execution when combined with the ability to upload .php files. The weakness is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact

Authenticated contributors can execute arbitrary PHP on vulnerable WordPress sites running WPCafe, leading to full site compromise when paired with file upload primitives.

Affected Products

• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress
• All versions up to and including 3.0.18
• WordPress sites allowing contributor-level or higher accounts

Discovery Timeline

• 2026-10-03 - CVE-2026-75028 published to the National Vulnerability Database
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-75028

Vulnerability Analysis

The vulnerability stems from unsafe handling of a template scope parameter used by multiple shortcodes and widgets within WPCafe. User-controlled input flows into PHP include/require statements without proper validation against a strict allowlist of template files. Affected code paths include core/shortcodes/views/food-menu/food-list.php, core/shortcodes/views/food-menu/location-menu.php, and widget files such as wpc-food-location.php, wpc-food-menu-tab.php, wpc-location-menu.php, and wpc-menus-list.php. Because WordPress contributor accounts can render shortcodes and widgets during content preview, the attack surface is reachable with low-privilege credentials.

Root Cause

The root cause is an [CWE-98] File Inclusion weakness. The plugin concatenates attacker-controlled template scope values into a filesystem path passed to a PHP inclusion function. Without canonicalization or allowlisting, the resolved path can reference arbitrary .php files on the webserver, including plugin, theme, uploaded, or system-reachable scripts.

Attack Vector

Exploitation requires an authenticated session with contributor-level privileges or higher. The attacker submits a crafted shortcode or widget configuration whose template scope attribute points to a .php file reachable from the webserver filesystem. When the shortcode or widget is rendered, PHP evaluates the included file in the context of the web process. If the attacker can also upload a .php file through any plugin, theme, or media handler, the LFI becomes a reliable remote code execution primitive.

For the vulnerable source lines, see the WPCafe food-list.php reference and the plugin change set.

Detection Methods for CVE-2026-75028

Indicators of Compromise

• Shortcode or widget submissions from contributor accounts containing template scope attributes referencing filesystem paths, traversal sequences such as ../, or absolute paths ending in .php.
• Web server logs showing POST requests to wp-admin/admin-ajax.php, post.php, or widgets.php from low-privilege users immediately followed by requests rendering WPCafe shortcodes.
• Unexpected PHP execution originating from wp-content/uploads/ or other non-plugin directories.

Detection Strategies

• Audit WordPress posts, pages, and widget configurations for WPCafe shortcodes with suspicious or non-standard template scope values.
• Enable WordPress debug logging and monitor PHP include/require warnings referencing attacker-controlled paths.
• Inspect recently created or modified .php files in wp-content/uploads/ and compare file hashes against known-good baselines.

Monitoring Recommendations

• Alert on new contributor or author accounts that promptly submit WPCafe shortcode content.
• Monitor outbound network traffic from the webserver for unexpected connections that may indicate webshell activity.
• Correlate WordPress audit logs with EDR telemetry on the hosting server to detect PHP processes spawning shells or writing new executables.

How to Mitigate CVE-2026-75028

Immediate Actions Required

• Update the WPCafe plugin to a version released after 3.0.18 that remediates the template scope inclusion flaw.
• Review and remove untrusted contributor, author, or editor accounts, and reset credentials for remaining low-privilege users.
• Scan the WordPress installation for unauthorized .php files, modified plugin files, and persistence mechanisms such as scheduled tasks or injected admin users.

Patch Information

The fix is tracked in the WordPress plugin repository change set referenced in the plugin change set record. Additional vendor and vulnerability intelligence is available via the Wordfence Vulnerability Intel entry. Administrators should upgrade to the patched release through the WordPress plugin updater and verify the installed version in the WordPress admin console.

Workarounds

• Temporarily deactivate the WPCafe plugin until the patched version is installed and verified.
• Restrict contributor and above capabilities by removing shortcode rendering permissions through a role-management plugin.
• Deploy a Web Application Firewall (WAF) rule to block requests containing WPCafe shortcode parameters with path traversal sequences or .php extensions in template scope values.

# Example WAF rule concept to block suspicious template scope values
# ModSecurity-style rule
SecRule ARGS_NAMES "@rx (scope|template)" \
  "chain,phase:2,deny,status:403,id:1750028,msg:'WPCafe LFI attempt'"
  SecRule ARGS "@rx (\.\./|\.php($|\?|&))" "t:lowercase,t:urlDecodeUni"