WPCafe Plugin Vulnerable to Local File Inclusion Attacks

CVE-2024-5431

Summary

The WPCafe plugin for WordPress, specifically the Online Food Ordering, Restaurant Menu, Delivery, and Reservations feature, contains a Local File Inclusion vulnerability. This issue is present in all plugin versions up to and including 2.2.25 and is exploited via the 'reservation_extra_field' shortcode parameter. Authenticated attackers with Contributor-level access or higher can leverage this vulnerability to include remote files on the server, which may result in unauthorized code execution. This susceptibility could severely compromise the security of the affected systems and necessitates immediate attention for those using the plugin.

References