CVE-2024-5431: WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode
The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservationextrafield shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, potentially resulting in code execution
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerceto a version that resolves this vulnerability.Fixed in 2.2.25
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5431?
CVE-2024-5431 has been classified with a high severity due to its potential for Local File Inclusion attacks.
How do I fix CVE-2024-5431?
To fix CVE-2024-5431, update the WPCafe plugin to a version newer than 2.2.25.
What are the potential consequences of CVE-2024-5431?
Exploitation of CVE-2024-5431 can lead to unauthorized file access on the server hosting the WordPress site.
Which versions of WPCafe are affected by CVE-2024-5431?
All versions of the WPCafe plugin up to and including 2.2.25 are affected by CVE-2024-5431.
Is there a workaround for CVE-2024-5431?
As of now, the best approach for CVE-2024-5431 is to update to a patched version, as no official workaround has been provided.